Enable DAST checks using OWASP Top 10 risk IDs as configuration

Currently individual checks in DAST can be enabled using the configuration DAST_CHECKS_TO_RUN which takes check IDs as input.

Proposal

Allow enabling a group of checks based on the OWASP top 10 categorisation of risks. For example, if a customer wants to test for "security misconfiguration", instead of going through the table of available checks and cross-referencing with the OWASP list, they can give A05 as an input to DAST to enable only those specific checks i.e. DAST_CHECKS_TO_RUN=A05.

This can help:

  • make configuring checks in DAST easier by relying on domains enumerated by OWASP Top 10.
  • allow customers to split their scans by domain (e.g. having a different CI job for A01 risks, A02 risks, ...) leading to concurrent results, and reduction in overall scan time.
Edited by Arpit Gogia