feat(lab5): ZAP baseline + auth + Semgrep + correlation

[IamdLite]

Goal

Run DAST (ZAP authenticated) + SAST (Semgrep) against Juice Shop v20.0.0 and correlate at least one vulnerability found by both tools.

Changes

• submissions/lab5.md — Complete SAST/DAST analysis with correlation findings

Testing

# ZAP baseline scan
docker run --rm --network lab5-net \
  -v "$(pwd)/labs/lab5/results:/zap/wrk" \
  ghcr.io/zaproxy/zaproxy:stable \
  zap-baseline.py -t http://juice-shop:3000 \
  -r baseline-report.html -J baseline-report.json

# ZAP authenticated scan
docker run --rm --network lab5-net \
  -e _JAVA_OPTIONS="-Xmx512m" \
  -v "$(pwd)/labs/lab5:/zap/wrk" \
  ghcr.io/zaproxy/zaproxy:stable \
  zap.sh -cmd -autorun /zap/wrk/scripts/zap-auth.yaml -port 8090

# Semgrep analysis
semgrep \
  --config=p/owasp-top-ten \
  --config=p/javascript \
  --config=p/secrets \
  labs/lab5/semgrep/juice-shop \
  --json -o labs/lab5/results/semgrep.json \
  --severity ERROR --severity WARNING

Results

• ZAP Baseline: 10 alerts (0 High, 2 Medium, 5 Low, 3 Info)
• ZAP Authenticated: 12 alerts (1 High, 4 Medium, 3 Low, 4 Info) — 1.2× increase
• Semgrep: 22 findings (12 ERROR, 10 WARNING)
• Correlation: SQL Injection on /rest/products/search and /rest/user/login found by both ZAP and Semgrep

Artifacts & Screenshots

• submissions/lab5.md — Full analysis with tables, code samples, and remediation
• labs/lab5/results/baseline-report.json — ZAP baseline findings
• labs/lab5/results/auth-report.json — ZAP authenticated findings
• labs/lab5/results/semgrep.json — Semgrep static analysis
• labs/lab5/results/semgrep.txt — Human-readable Semgrep findings
• labs/lab5/results/zap-comparison.txt — Baseline vs authenticated comparison

Checklist

• Title uses feat(lab5): SAST + DAST correlation style
• No secrets/large temp files committed
• submissions/lab5.md present with all three tasks completed
• All metrics verified against artifacts (baseline: 10, auth: 12, semgrep: 22)
• Correlation findings documented with ZAP payloads and Semgrep file:line references
• False positive properly contextualized (challenge code directory)
• Remediation code and reflection included
• Task 1 — ZAP baseline + auth + 10-20× ratio analysis
• Task 2 — Semgrep top-10 + triage shortcut
• Bonus — Correlation table with 1+ confirmed cross-tool finding