Triages web application vulnerability findings from DAST/SAST scanners such as Burp Suite and ZAP, using the OWASP Risk Rating Methodology to confirm true positives, dismiss false positives, and prioritize remediation. Use when reviewing scanner output to reduce alert fatigue and rank vulnerabilitie

Performing Web Application Vulnerability Triage Overview Web application vulnerability triage is the process of reviewing findings from DAST (Dynamic Application Security Testing) and SAST (Static Application Security Testing) tools to validate true positives, dismiss false positives, assign risk ratings using the OWASP Risk Rating Methodology, and prioritize remediation. Effective triage reduces alert fatigue and focuses development teams on the vulnerabilities that matter most. When to Use When conducting security assessments that involve performing web application vulnerability triage When following incident response procedures for related security events When performing scheduled security testing or auditing activities When validating security controls through hands on testing Prerequisites DAST scan results (OWASP ZAP, Burp Suite, Acunetix) SAST scan results (Semgrep, SonarQube, Checkmarx, Snyk Code) Python 3.9+ with requests , beautifulsoup4 Burp Suite Professional or OWASP ZAP for manual validation DefectDojo or similar for finding management OWASP Risk Rating Methodology Risk Calculation Likelihood Factors (0 9 scale) Factor Group Factor Description Threat Agent Skill Level How technically skilled is the attacker? Threat Agent Motive How motivated is the attacker? Threat Agent Opportunity What resources/access are needed? Threat Agent Size How large is the potential threat agent group? Vulnerability Ease of Discovery How easy is it to find the vulnerability? Vulnerability Ease of Exploit How easy is it to exploit? Vulnerability Awareness How well known is the vulnerability? Vulnerability Intrusion Detection How likely is exploitation to be detected? Impact Factors (0 9 scale) Factor Group Factor Description Technical Confidentiality How much data could be disclosed? Technical Integrity How much data could be corrupted? Technical Availability How much service could be lost? Technical Accountability Can actions be traced to attacker? Business Financial Damage Revenue loss, regulatory fines Business Reputation Damage Brand trust erosion Business Non compliance Regulatory violation exposure Business Privacy Violation PII/PHI exposure volume Risk Matrix Low Impact (0 3) Medium Impact (3 6) High Impact (6 9) High Likelihood (6 9) Medium High Critical Medium Likelihood (3 6) Low Medium High Low Likelihood (0 3) Note Low Medium Triage Process Step 1: Categorize by OWASP Top 10 Step 2: Validate True vs False Positives Step 3: Risk Score Calculation Step 4: Generate Triage Report Manual Validation Techniques SQL Injection Validation XSS Validation References [OWASP Risk Rating Methodology](https://owasp.org/www community/OWASP Risk Rating Methodology) [OWASP Top 10 2021](https://owasp.org/www project top ten/) [OWASP Testing Guide v4.2](https://owasp.org/www project web security testing guide/) [CWE/SANS Top 25](https://cwe.mitre.org/top25/)

performing-web-application-vulnerability-triage