Feature/lab5

[raylduk8]

Goal

Run DAST (ZAP, both unauthenticated and authenticated) against the running Juice Shop, then run SAST (Semgrep) against its source code.

Changes

• submissions/lab5.md

Testing

Compare authenticated vs unauthenticated ZAP scans

bash labs/lab5/scripts/[compare_zap.sh](https://vk.com/away.php?to=https%3A%2F%2Fcompare_zap.sh&utf=1) \

  labs/lab5/results/baseline-report.json \

  labs/lab5/results/auth-report.json

SAST with Semgrep severity breakdown

jq '[.results[].extra.severity] | group_by(.) | map({severity: .[0], count: length})' \

  labs/lab5/results/semgrep.json

SAST with Semgrep top 10 rule id by frequency

jq '[.results[].check_id] | group_by(.) | map({rule: .[0], count: length}) |

    sort_by(-.count) | .[:10]' \

  labs/lab5/results/semgrep.json

• Task 1 — ZAP baseline + auth + 10-20× ratio analysis
• Task 2 — Semgrep top-10 + triage shortcut
• Bonus — Correlation table with 1+ confirmed cross-tool finding