Análise de cobertura e precisão em ferramentas DAST: um comparativo técnico entre Owasp Zap e Nuclei utilizando o Damn Vulnerable Web App (DVWA)

Abstract

The accelerated growth of web applications and the migration of critical services to the digital environment have expanded the attack surface and the frequency of cyber incidents, making early vulnerability detection a mandatory requirement for data protection. In this scenario, Dynamic Application Security Testing (DAST) tools emerge as essential solutions for automating audits, although they present significant variations in effectiveness depending on their architecture and search engine. This article presents a comparative analysis of coverage and accuracy between the OWASP ZAP and Nuclei tools in identifying flaws based on the global consensus of the OWASP Top 10. The methodology adopted consisted of experimental research in a virtualized and isolated environment, using the intentionally vulnerable application Damn Vulnerable Web App (DVWA) configurated at the “Low” and “Medium” security levels. The results demonstrate the technical distinctions between ZAP’s proxy-based active scanning approach and Nuclei’s fast template-oriented model, revealing how each tool behaves in the face of basic security filters and distinct attack surfaces. It is concluded that the effectiveness of automation is dependent on the context of the target application, highlighting the need for hybrid testing strategies to ensure the robustness and technical compliance of contemporary web systems.