Integrating Noir into Your DAST Pipeline

Integrate Noir into your DAST pipeline with ZAP, Burp Suite, Caido, or Gori.

Feed Noir's endpoint list into your DAST pipeline so the scanner tests every route the code defines, not only the ones a crawler finds.

Hak, the OWASP Noir mascot — I found the routes; your DAST tool scans them. Hand the list over as OpenAPI or push it straight through a proxy.

Integrating with a Proxy Tool

Use --probe-via (Delivering Results to Other Tools) to send discovered endpoints to a proxy like OWASP ZAP, Burp Suite, Caido, or Gori.

noir scan . -u http://localhost:3000 --probe-via "http://localhost:8080"

This scans the current directory, constructs URLs using http://localhost:3000 as the base, and sends all endpoints to the proxy at http://localhost:8080.

Integrating with ZAP Automation

Generate an OpenAPI specification with Noir and feed it into ZAP's automation framework.

Discover Endpoints:

noir scan ~/app_source -f oas3 --no-log -o doc.json

Run ZAP Scan:

./zap.sh -openapifile ./doc.json \
    -openapitargeturl <TARGET> \
    -cmd -autorun zap.yaml <any other ZAP options>

For more details, see the ZAP blog post: Powering Up DAST with ZAP and Noir.