Feature/lab5

[raaller]

Goal

Lab 5: ZAP baseline + authenticated DAST, Semgrep SAST, and SAST/DAST correlation on Juice Shop v20.0.0.

Changes

• Add submissions/lab5.md with full analysis report

Testing

# ZAP baseline scan
docker run --rm --network lab5-net \
  -v "$(pwd)/labs/lab5/results:/zap/wrk" \
  ghcr.io/zaproxy/zaproxy:stable \
  zap-baseline.py -t http://juice-shop:3000 \
  -r baseline-report.html -J baseline-report.json
# Result: 10 alert types, 0 High

# ZAP authenticated scan
docker run --rm --network lab5-net \
  -e _JAVA_OPTIONS="-Xmx512m" \
  -v "$(pwd)/labs/lab5:/zap/wrk" \
  ghcr.io/zaproxy/zaproxy:stable \
  zap.sh -cmd -autorun /zap/wrk/scripts/zap-auth.yaml -port 8090
# Result: 12 alert types, 1 High (SQL Injection)

# Semgrep SAST
semgrep --config=p/owasp-top-ten --config=p/javascript --config=p/secrets \
  labs/lab5/semgrep/juice-shop \
  --json -o labs/lab5/results/semgrep.json \
  --severity ERROR --severity WARNING
# Result: 22 findings (12 ERROR + 10 WARNING)

Artifacts & Screenshots

submissions/lab5.md

Checklist

[x] Title is clear (feat(labN): <topic> style)
[x] No secrets/large temp files committed
[x] Submission file at submissions/lab5.md exists
[x] Task 1 — ZAP baseline + auth + 10-20× ratio analysis
[x] Task 2 — Semgrep top-10 + triage shortcut
[x] Bonus — Correlation table with 1+ confirmed cross-tool finding