DAST Showdown: OWASP ZAP 2.16 vs. Burp Suite 2026 vs. Acunetix 2026 for Web App Security

import time
import sys
import logging
from zapv2 import ZAPv2

# Configure logging for debug output
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
logger = logging.getLogger(__name__)

class ZAPHeadlessScanner:
    def __init__(self, zap_path='/usr/share/zaproxy/', api_key='zv8w7f6e5d4c3b2a1'):
        \"\"\"Initialize ZAPv2 client with local ZAP instance.

        Args:
            zap_path: Path to ZAP installation directory
            api_key: ZAP API key (configure in ZAP -> Tools -> Options -> API)
        \"\"\"
        try:
            self.zap = ZAPv2(apikey=api_key, proxies={'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'})
            logger.info(f\"Connected to ZAP instance at 127.0.0.1:8080\")
            # Verify ZAP version matches benchmark target
            zap_version = self.zap.core.version
            if not zap_version.startswith('2.16'):
                logger.warning(f\"ZAP version {zap_version} does not match benchmark target 2.16.0\")
        except Exception as e:
            logger.error(f\"Failed to connect to ZAP: {str(e)}\")
            sys.exit(1)

    def scan_target(self, target_url, scan_policy='baseline'):
        \"\"\"Run DAST scan against target URL.

        Args:
            target_url: Full URL of target to scan (e.g., https://example.com)
            scan_policy: 'baseline' (quick) or 'full' (deep scan)
        \"\"\"
        try:
            # Start ZAP spider to crawl target
            logger.info(f\"Starting spider for {target_url}\")
            spider_id = self.zap.spider.scan(target_url)
            time.sleep(2)

            # Wait for spider to complete
            while int(self.zap.spider.status(spider_id)) < 100:
                logger.info(f\"Spider progress: {self.zap.spider.status(spider_id)}%\")
                time.sleep(5)
            logger.info(f\"Spider completed. Found {len(self.zap.spider.results(spider_id))} URLs\")

            # Start active scan
            logger.info(f\"Starting active scan with policy: {scan_policy}\")
            if scan_policy == 'baseline':
                # Baseline scan excludes high-intensity checks
                scan_id = self.zap.ascan.scan(target_url, recurse=True, in_scope_only=True)
            else:
                scan_id = self.zap.ascan.scan(target_url, recurse=True, in_scope_only=False)

            # Wait for active scan to complete
            while int(self.zap.ascan.status(scan_id)) < 100:
                logger.info(f\"Active scan progress: {self.zap.ascan.status(scan_id)}%\")
                time.sleep(10)
            logger.info(f\"Active scan completed. Found {len(self.zap.core.alerts())} alerts\")

            # Generate JSON report
            report = self.zap.core.jsonreport()
            with open(f'zap_scan_{int(time.time())}.json', 'w') as f:
                f.write(report)
            logger.info(f\"Scan report saved to zap_scan_{int(time.time())}.json\")
            return self.zap.core.alerts()

        except Exception as e:
            logger.error(f\"Scan failed: {str(e)}\")
            return []

    def filter_critical_alerts(self, alerts):
        \"\"\"Filter alerts to only critical severity (OWASP Top 10 A01-A10).\"\"\"
        critical = []
        for alert in alerts:
            if alert.get('risk') == 'High' and any(cwe in alert.get('cweid', '') for cwe in ['79', '89', '200', '352', '434', '676', '798', '922', '942', '987']):
                critical.append(alert)
        logger.info(f\"Found {len(critical)} critical OWASP Top 10 alerts\")
        return critical

if __name__ == '__main__':
    # Benchmark target: WebGoat 2023.4 on localhost:8081
    TARGET_URL = 'http://localhost:8081/WebGoat/'
    SCAN_POLICY = 'full'

    scanner = ZAPHeadlessScanner()
    alerts = scanner.scan_target(TARGET_URL, SCAN_POLICY)
    critical_alerts = scanner.filter_critical_alerts(alerts)

    print(f\"\n=== Scan Summary ===\")
    print(f\"Total alerts: {len(alerts)}\")
    print(f\"Critical OWASP Top 10 alerts: {len(critical_alerts)}\")
    sys.exit(0)

import time
import requests
import json
import sys
import logging
from datetime import datetime

logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
logger = logging.getLogger(__name__)

class BurpRESTScanner:
    def __init__(self, burp_url='http://127.0.0.1:1337', api_key='brtp-2026-api-987654321'):
        \"\"\"Initialize Burp Suite 2026 REST API client.

        Args:
            burp_url: URL of Burp Suite Professional instance with REST API enabled
            api_key: API key from Burp -> Settings -> API -> REST API
        \"\"\"
        self.burp_url = burp_url.rstrip('/')
        self.headers = {
            'Authorization': f'Bearer {api_key}',
            'Content-Type': 'application/json'
        }
        try:
            # Verify Burp version
            resp = requests.get(f'{self.burp_url}/api/version', headers=self.headers)
            resp.raise_for_status()
            version = resp.json().get('version', '')
            if not version.startswith('2026'):
                logger.warning(f\"Burp version {version} does not match benchmark target 2026.1\")
            logger.info(f\"Connected to Burp Suite {version} at {burp_url}\")
        except Exception as e:
            logger.error(f\"Failed to connect to Burp REST API: {str(e)}\")
            sys.exit(1)

    def create_scan_config(self, target_url, config_name='ci-cd-scan'):
        \"\"\"Create a scan configuration for automated CI/CD scans.

        Args:
            target_url: Target URL to scan
            config_name: Name of scan configuration
        \"\"\"
        config_payload = {
            \"name\": config_name,
            \"scan_type\": \"web_app\",
            \"targets\": [{\"url\": target_url, \"enabled\": True}],
            \"crawl_settings\": {
                \"max_depth\": 5,
                \"max_urls\": 1000,
                \"crawl_spa\": True
            },
            \"audit_settings\": {
                \"intensity\": \"medium\",
                \"exclude_high_risk\": False
            }
        }
        try:
            resp = requests.post(f'{self.burp_url}/api/scan-configs', headers=self.headers, json=config_payload)
            resp.raise_for_status()
            config_id = resp.json().get('config_id')
            logger.info(f\"Created scan config {config_id} for {target_url}\")
            return config_id
        except Exception as e:
            logger.error(f\"Failed to create scan config: {str(e)}\")
            return None

    def start_scan(self, config_id):
        \"\"\"Start a scan using the provided configuration ID.\"\"\"
        try:
            resp = requests.post(f'{self.burp_url}/api/scans', headers=self.headers, json={'config_id': config_id})
            resp.raise_for_status()
            scan_id = resp.json().get('scan_id')
            logger.info(f\"Started scan {scan_id}\")
            return scan_id
        except Exception as e:
            logger.error(f\"Failed to start scan: {str(e)}\")
            return None

    def poll_scan_status(self, scan_id, poll_interval=30):
        \"\"\"Poll scan status until completion.\"\"\"
        while True:
            try:
                resp = requests.get(f'{self.burp_url}/api/scans/{scan_id}', headers=self.headers)
                resp.raise_for_status()
                status = resp.json().get('status')
                progress = resp.json().get('progress', 0)
                logger.info(f\"Scan {scan_id} status: {status} ({progress}%)\")
                if status in ['completed', 'failed', 'cancelled']:
                    return status
                time.sleep(poll_interval)
            except Exception as e:
                logger.error(f\"Failed to poll scan status: {str(e)}\")
                time.sleep(poll_interval)

    def download_report(self, scan_id, report_format='json'):
        \"\"\"Download scan report in specified format.\"\"\"
        try:
            resp = requests.get(f'{self.burp_url}/api/scans/{scan_id}/report?format={report_format}', headers=self.headers)
            resp.raise_for_status()
            report_path = f'burp_scan_{datetime.now().strftime(\"%Y%m%d_%H%M%S\")}.{report_format}'
            with open(report_path, 'wb') as f:
                f.write(resp.content)
            logger.info(f\"Report saved to {report_path}\")
            return report_path
        except Exception as e:
            logger.error(f\"Failed to download report: {str(e)}\")
            return None

if __name__ == '__main__':
    TARGET_URL = 'https://staging.example.com'
    API_KEY = 'brtp-2026-api-987654321'  # Replace with actual Burp 2026 API key

    scanner = BurpRESTScanner(api_key=API_KEY)
    config_id = scanner.create_scan_config(TARGET_URL)
    if not config_id:
        sys.exit(1)

    scan_id = scanner.start_scan(config_id)
    if not scan_id:
        sys.exit(1)

    final_status = scanner.poll_scan_status(scan_id)
    if final_status == 'completed':
        scanner.download_report(scan_id)
        print(f\"\n=== Burp Scan {scan_id} Completed Successfully ===\")
    else:
        print(f\"\n=== Burp Scan {scan_id} Failed with Status: {final_status} ===\")
        sys.exit(1)

#!/bin/bash

# Acunetix 2026 CLI Scan Script with Custom Payloads
# Benchmark version: Acunetix 2026.0.0 (build 20260312)
# Usage: ./acunetix_scan.sh 

set -euo pipefail  # Exit on error, undefined vars, pipe failures

# Configuration
ACUNETIX_URL="https://localhost:3443"
API_KEY="acx-2026-api-123456789"
SCAN_PROFILE="DeepScan"
REPORT_FORMAT="json"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
LOG_FILE="acunetix_scan_${TIMESTAMP}.log"

# Custom payload file (benchmark-tested SQL injection payloads)
CUSTOM_PAYLOADS="/opt/acunetix_2026/payloads/custom_sqli.json"

# Function to log messages
log_message() {
    echo "[$(date +'%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}

# Function to handle errors
handle_error() {
    log_message "ERROR: $1"
    exit 1
}

# Validate arguments
if [ $# -ne 1 ]; then
    log_message "Usage: $0 "
    exit 1
fi
TARGET_URL="$1"

# Verify Acunetix CLI is installed
if ! command -v acunetix-cli &> /dev/null; then
    handle_error "acunetix-cli not found. Install Acunetix 2026 CLI first."
fi

# Verify target URL is reachable
log_message "Checking target reachability: $TARGET_URL"
if ! curl -s --head --connect-timeout 10 "$TARGET_URL" > /dev/null; then
    handle_error "Target URL $TARGET_URL is unreachable."
fi

# Create custom payload file if not exists
if [ ! -f "$CUSTOM_PAYLOADS" ]; then
    log_message "Creating custom payload file: $CUSTOM_PAYLOADS"
    cat > "$CUSTOM_PAYLOADS" << EOF
{
    "payloads": [
        "' OR 1=1--",
        "' UNION SELECT null, version(), null--",
        "admin' --",
        "' OR 'x'='x'--"
    ],
    "vulnerability_type": "SQL Injection"
}
EOF
fi

# Start Acunetix scan
log_message "Starting Acunetix scan for $TARGET_URL"
SCAN_ID=$(acunetix-cli scan start \
    --url "$ACUNETIX_URL" \
    --api-key "$API_KEY" \
    --target "$TARGET_URL" \
    --profile "$SCAN_PROFILE" \
    --custom-payloads "$CUSTOM_PAYLOADS" \
    --format json | jq -r '.scan_id')

if [ -z "$SCAN_ID" ]; then
    handle_error "Failed to start Acunetix scan. Check API key and permissions."
fi
log_message "Scan started with ID: $SCAN_ID"

# Poll scan status
while true; do
    SCAN_STATUS=$(acunetix-cli scan status \
        --url "$ACUNETIX_URL" \
        --api-key "$API_KEY" \
        --scan-id "$SCAN_ID" \
        --format json | jq -r '.status')

    log_message "Scan $SCAN_ID status: $SCAN_STATUS"

    if [ "$SCAN_STATUS" = "completed" ]; then
        log_message "Scan completed successfully."
        break
    elif [ "$SCAN_STATUS" = "failed" ]; then
        handle_error "Scan $SCAN_ID failed."
    fi

    sleep 30
done

# Download report
REPORT_FILE="acunetix_report_${TIMESTAMP}.${REPORT_FORMAT}"
log_message "Downloading report to $REPORT_FILE"
acunetix-cli report download \
    --url "$ACUNETIX_URL" \
    --api-key "$API_KEY" \
    --scan-id "$SCAN_ID" \
    --format "$REPORT_FORMAT" \
    --output "$REPORT_FILE"

if [ ! -f "$REPORT_FILE" ]; then
    handle_error "Failed to download report."
fi

# Parse critical vulnerabilities
CRITICAL_COUNT=$(jq '[.vulnerabilities[] | select(.severity == "high")] | length' "$REPORT_FILE")
log_message "Found $CRITICAL_COUNT critical vulnerabilities."

log_message "Scan process completed. Log: $LOG_FILE, Report: $REPORT_FILE"
exit 0

- name: Run ZAP Baseline Scan
  uses: zaproxy/action-baseline@v0.10.0
  with:
    target: 'https://staging.example.com'
    rules_file_name: '.zap/rules.tsv'
    cmd_options: '-a -j -m 10'

curl -X POST "http://127.0.0.1:1337/api/extensions/install" \
  -H "Authorization: Bearer $BURP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"extension_id": "auth-matrix-v2"}'

acunetix-cli scan start \
  --target "https://api.example.com" \
  --profile "ProductionAPI" \
  --rate-limit 10 \
  --exclude "/api/checkout,/api/search" \
  --smart-scan true