feat(lab5): ZAP baseline + auth + Semgrep + correlation

[witch2256]

Goal

Complete Lab 5 — SAST + DAST: Scanning Juice Shop From Both Angles (main tasks)

Changes

• Added submissions/lab5.md with detailed answers for:
  • DAST baseline (unauthenticated) scan statistics (10 alerts: 0 High, 2 Medium, 5 Low, 3 Info)
  • DAST authenticated full scan statistics (12 alerts: 1 High, 4 Medium, 3 Low, 4 Info)
  • Auth/baseline ratio analysis (12/10 = 1.2×) with honest discussion of why lecture's 10–20× claim wasn't matched (active scan time limited to 3 minutes, Juice Shop vulnerabilities mostly exposed without auth, authentication context coverage)
  • Two auth‑only alerts (SQL Injection High, Session ID in URL Rewrite Medium) with evidence and reasoning why they're unreachable without login
  • SAST (Semgrep) OWASP Top 10 scan results (no findings at ERROR/WARNING level with --config=auto; documented in report)
  • Triage shortcut analysis based on available SAST data
  • False‑positive sample review (none identified due to empty SAST results)
• Modified labs/lab5/scripts/zap-auth.yaml — updated URLs from localhost:3000 to juice-shop:3000 for Docker network compatibility

Testing & Verification

• ZAP baseline scan completed successfully; baseline-report.json generated with 10 alerts (0 High, 2 Medium, 5 Low, 3 Info)
• ZAP authenticated scan completed successfully; auth-report.json generated with 12 alerts (1 High, 4 Medium, 3 Low, 4 Info)
• Active scan completed in ~3 minutes (limited by maxScanDurationInMins: 15, actual runtime ~3 min)
• Semgrep SAST scan completed with --config=auto; no findings at ERROR/WARNING level (results empty)
• Juice Shop container pinned to v20.0.0 — matches source code version
• Docker network lab5-net properly configured; both containers communicate via service name

Artifacts & Screenshots

• submissions/lab5.md
• labs/lab5/results/baseline-report.json (not committed, but referenced)
• labs/lab5/results/auth-report.json (not committed, but referenced)
• labs/lab5/results/semgrep.json (not committed, but referenced)

Checklist

• Title is clear

• No secrets committed

• Submission file exists

• Task 1 — ZAP baseline + auth + 10–20× ratio analysis (ratio: 1.2×, documented in report)

• Task 2 — Semgrep top‑10 + triage shortcut (empty results, documented in report)