Lab 5 — SAST + DAST: Scanning Juice Shop From Both Angles

[Nik-ari-ai]

##Goal:
Run DAST (ZAP, both unauthenticated and authenticated) against the running Juice Shop, then run SAST (Semgrep) against its source code, and correlate at least one vulnerability that appears in both reports.

Changes

• submissions/lab05.md — report
• .gitignore — skip Lab 5 scan outputs and Juice Shop source clone

Testing

• ZAP baseline: 10 alerts (0 high/2 medium/5 low/3 info), 41 instances
• ZAP authenticated: 12 alerts (1 high/4 medium/3 low/4 info), 42 instances
• Semgrep: 22 findings (12 ERROR + 10 WARNING) across 7 rules
• Correlation: SQL Injection at routes/search.ts:23

Artifacts & Screenshots

• submissions/lab05.md

Checklist

• Task 1 — ZAP baseline + auth + 10-20× ratio analysis
• Task 2 — Semgrep top-10 + triage shortcut
• Bonus — Correlation table with 1+ confirmed cross-tool finding