DAST - Dynamic Application Security Testing

Sidebar: Testing → DAST Scans (/scans)

DAST tests your running application the way an attacker would: it crawls the app, sends real attack payloads, and confirms what actually works. Unlike static analysis, it needs no source code (though attaching source enables deeper gray-box testing).

The two-stage pipeline

Every scan runs as two visible stages:

The first stage discovers and attacks; the second runs an autonomous agent pentest that reads each response, adapts the next payload, chains findings into a proven kill chain, and captures a per-finding Attack Trace. You watch it happen live in the Agent Cockpit. For the full phase-by-phase breakdown see the Scan Pipeline architecture.

What DAST tests

Coverage spans the OWASP Top 10 and beyond, including:

• Injection - SQLi (boolean, time, fused conditional-sleep and out-of-band oracles), command, template (SSTI), XPath, LDAP and NoSQL.
• XSS - reflected, stored, and DOM-based (via a real headless browser), plus second-order / stored injection confirmed out-of-band.
• Access control - IDOR / BOLA, including object-graph IDOR (following a reference into another object) and 2-user checks on header-authenticated APIs.
• Authentication & session - weak and auth-bypass flows.
• SSRF including cloud-metadata (IMDS) role enumeration to AWS credential exfil, path traversal / LFI / RFI, deserialization, and security misconfiguration.
• Business logic - stateful race conditions and multi-step financial-tamper workflows the agent executes and proves by reading state back.
• Cross-finding chaining - a leaked credential replayed against a privileged endpoint, an SSRF that reaches the metadata service, a reference that walks the object graph: the engine feeds one primitive forward instead of testing endpoints in isolation.
• API testing - schema fuzzing plus first-class OpenAPI/Swagger spec input so declared endpoints are exercised directly.

Gray-box testing

When a target has source code attached, DAST becomes source-informed: it knows the routes, parameters and sink locations, so it crafts far more precise attacks and produces higher-confidence findings.

Where results go

• The scan detail page shows live progress, the attack map, coverage and per-finding proof-of-exploit - see Reading scan results.
• Findings are unified into the Vulnerabilities hub.
• Each run is recorded as an Assessment.

Next

• Running a scan - the new-scan wizard and profiles.
• Authenticated scanning - test logged-in surface.
• Agent Cockpit & Attack Trace - watch the pentest live and read a proven kill chain.
• Reading scan results - interpret the detail page.