<![CDATA[This study discusses a comparative analysis of non-intrusive vulnerability scanning results on public e-commerce web applications using OWASP ZAP and Nuclei. This study is not intended to directly prove vulnerability exploitation, but rather to evaluate the characteristics of scanning outputs based on the number of aggregate findings, unique findings after deduplication, CVSS v3.1 severity distribution, OWASP Top 10 mapping, overlap, and priority findings that require manual validation. Testing was conducted using a black-box and non-intrusive approach on five targets coded E1 to E5. The coding was applied to maintain testing ethics on public targets, while target selection was based on open web application access, relevance to the e-commerce context, and variations in service characteristics that could be observed externally. The results showed 83 aggregate findings, consisting of 68 OWASP ZAP findings and 15 Nuclei findings. After the normalization and deduplication process, 81 unique findings were obtained with 2 overlapping findings. OWASP ZAP produced more consistent outputs across several targets and was dominant in the Security Misconfiguration category, particularly security headers, Content Security Policy, cache-control, and cookie attributes. Meanwhile, Nuclei produced fewer findings but made an important contribution by detecting 5 Critical findings and 3 High findings, especially on target E4. The limitation of this study lies in output constraints on several targets; therefore, the scanning results cannot be interpreted as the final security condition of the targets, but rather as initial technical indications that require further validation. This study does not measure precision, recall, false positive rate, or scanning time efficiency because the testing was conducted on public targets under non-intrusive limitations and without Proof of Concept. The results indicate that the combination of OWASP ZAP and Nuclei provides more complete analysis coverage than the use of a single scanner because both have different and complementary detection characteristics.]]>
