docs: add lab5 submission - SAST/multi-approach DAST security analysis (Post Zap Fix)

[3llimi]

Goal

Perform Static Application Security Testing (SAST) using Semgrep and Dynamic Application Security Testing (DAST) using ZAP, Nuclei, Nikto, and SQLmap against OWASP Juice Shop v19.0.0. Identify, compare, and correlate vulnerabilities across both approaches to demonstrate comprehensive DevSecOps security coverage.

Changes

• labs/submission5.md Full analysis report covering SAST findings, DAST multi-tool comparison, and SAST/DAST correlation with security recommendations
• labs/lab5/semgrep/semgrep-results.json — Semgrep JSON output (25 findings across 1,014 files)
• labs/lab5/semgrep/semgrep-report.txt — Human-readable Semgrep report
• labs/lab5/zap/report-noauth.html — ZAP unauthenticated baseline scan report
• labs/lab5/zap/report-auth.html — ZAP authenticated scan report
• labs/lab5/zap/zap-report-noauth.json — ZAP unauthenticated results (JSON)
• labs/lab5/nuclei/nuclei-results.json — Nuclei template scan results (25 matches)
• labs/lab5/nikto/nikto-results.txt — Nikto web server scan results (84 findings)
• labs/lab5/sqlmap/ — SQLmap output confirming boolean-based blind SQLi on search endpoint
• labs/lab5/analysis/sast-analysis.txt — SAST summary analysis
• labs/lab5/analysis/correlation.txt — SAST/DAST correlation report

Testing

• Ran Semgrep with p/security-audit and p/owasp-top-ten rule packs against cloned Juice Shop v19.0.0 source (1,014 files scanned)
• Verified Juice Shop was running via curl -s http://localhost:3000 before all DAST scans
• Confirmed ZAP authentication was working by checking JWT token returned from /rest/user/login before authenticated scan
• Ran ZAP unauthenticated baseline (95 URLs) and authenticated AJAX spider scan (625 URLs total) — confirmed 6.6× URL discovery improvement
• Ran Nuclei with template update (-ut) against http://localhost:3000
• Ran Nikto full scan (completed in 158 seconds, 84 findings)
• Confirmed SQL injection on /rest/products/search?q=* with SQLmap boolean-based blind technique; DBMS identified as SQLite
• Ran compare_zap.sh and summarize_dast.sh to aggregate cross-tool results

Artifacts & Screenshots

• labs/lab5/zap/report-auth.html — Full ZAP authenticated scan report with alert details
• labs/lab5/zap/report-noauth.html — ZAP unauthenticated baseline for comparison
• labs/lab5/nuclei/nuclei-results.json — Nuclei JSONL results including Prometheus metrics exposure finding
• labs/lab5/nikto/nikto-results.txt — Nikto output confirming FTP directory access and missing headers
• labs/lab5/sqlmap/ — SQLmap session files with confirmed payload: ') AND 3692=3692 AND ('DEov' LIKE 'DEov
• labs/lab5/analysis/correlation.txt — Cross-tool finding counts summary

---

Checklist

• PR title is clear and descriptive
• Documentation updated if needed
• No secrets or large temporary files committed