ZAP API Scan — Tune for an OpenAPI Spec
devsecops · medium · +45 XP
Target
GET /api/lab/zap-api-101/openapi (sample OpenAPI 3.0 spec — 5 endpoints)
POST /api/lab/zap-api-101/configure body {auth_header, excluded_rules: [...]}
POST /api/lab/zap-api-101/submit body {critical_finding}
Goal: configure ZAP with header Authorization: Bearer <token> and exclude rule 10038 (CSP). Then submit the one critical finding ZAP returns: an unauthed /admin/users endpoint.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/zap-api-101/
// reuse on the cli
// submit flag
// no solves yet