How to select a DAST scanner

Key takeaways

 

• Web applications are now complex and constantly changing patchworks of first-party and third-party code, connected by APIs and deployed across dynamic cloud-based infrastructures. Testing what is actually running and not just the source code is a must for application security.
• DAST scanners test from the outside in to find security weaknesses, misconfigurations, and vulnerable components in running web applications, making them technology-agnostic security tools that can fit a variety of use cases in development and production.
• Any DAST tool consists of a scan engine, a set of security checks, and additional functionality for running scans, managing results, and integrating with other tools. Each of these can make or break your AppSec program, so it’s vital to understand the capabilities and limitations of the available types of DAST scanners.

What is a dynamic application security scanner?

A DAST scanner safely and automatically simulates web attacks on a running web application or API and looks for reactions that indicate vulnerabilities. Also called web vulnerability scanners or black-box scanners, DAST tools excel at finding security vulnerabilities such as SQL injection, cross-site scripting (XSS), server-side request forgery (SSRF), misconfigured HTTP security headers, and more. Advanced DAST solutions can also perform asset discovery, identify outdated web stack components, and integrate with existing workflows as well as other AppSec tools.

Note that a DAST scanner doesn’t analyze application source code—that’s the domain of static application security testing (SAST) tools. Unlike SAST, which works with a specific codebase and language, DAST is technology-agnostic and can find runtime security issues regardless of the programming language, application framework, deployment architecture, development activity, and availability of source code.

How do DAST scanners work?

Running a security scan using a DAST tool involves going through several common steps, with various products differing in the level of functionality, automation, and accuracy they provide at each step:

• Crawling and discovery: Before testing can begin, you need to know what to test. This crucial first stage can include web asset discovery, site crawling, and API discovery to create a list of potential attack points for the scanner. Especially in larger environments, prioritization is also a common step to narrow down your list of test targets. A basic manual scanner might only do testing and require you to manually specify the URLs to test, while more advanced tools will include a crawler and possibly discovery features.
• Vulnerability testing: Taking the list of app and API URLs and parameters, a DAST scanner automatically sends test attack payloads to those entry points and then monitors application responses and behaviors to detect vulnerabilities and misconfigurations. Some scanners are able to safely exploit many typical web application vulnerabilities and extract a proof of exploit, while others rely on less certain signals. The number, quality, and maturity of attack patterns is what determines how good a DAST scanner is at finding vulnerabilities.
• Vulnerability triage and reporting: The scanner reports identified (or suspected) security issues to the user, usually also assigning a severity score to aid prioritization. At this stage, false positives can be a major headache with less accurate tools, requiring AppSec engineers or developers to manually verify some or all reported issues before remediation. Tools also vary in where they report results, with more advanced solutions providing issue tracker integrations in addition to their own reporting interface.
• Remediation support and vulnerability management: Remediation is the reason you want to find security issues in the first place, so turning DAST results into tickets and fixes is a crucial part of the process—as is tracking the resolution status of reported vulnerabilities. After addressing a security-related bug, you also need to test whether the fix was effective to avoid partial fixes that leave you vulnerable. A basic scanner returns the results and the rest is up to you. Full-fledged DAST solutions have their own vulnerability management and retesting features, with the option to integrate with industry-standard external systems.

Types of DAST scanner tools: Which is right for you?

At the heart of any DAST scanner is the scan engine—the component that actually runs security checks (mock attacks) against a website, web app, or API. The differences between DAST tools boil down to two things: the quality of the engine and security checks themselves, and how much functionality you get in addition to the bare engine. Based on those criteria plus cost, here are a few ways to think about the available classes of DAST scanners:

Penetration testing tool vs. automated DAST solution

Vulnerability scanners were originally created by and for pentesters to automate recon work and deliver a list of promising candidates for manual investigation. Many popular scanners, both open-source and commercial, fall into this category of manual pentesting tools that are designed for security experts who are testing a specific target and have the skills to sift through potential false positives to find real vulnerabilities.

At the other end of this spectrum are automated DAST solutions that, once set up, can regularly crawl and test thousands of apps, sites, and API endpoints without manual intervention. These are typically designed to integrate into a DevOps workflow and deliver vulnerability reports directly to developers, making accuracy and detailed technical reporting a crucial requirement.

Open-source vs. commercial DAST scanner

Pentesting scanners also include some open-source tools, such as ZAP or Nuclei. Again, these are intended for security experts who are willing and able to manually investigate each scan result as well as spend time fine-tuning and customizing their tools for specific assignments. While ostensibly free, open-source DAST tools can be resource-intensive to set up, run, integrate, and verify results, making them less suitable for organizations.

Commercial DAST tools typically offer more functionality and automation than open-source tools, but what you get for your money varies widely. In fact, several commercial DAST scanners are essentially ZAP wrappers that build on top of the open-source scan engine to make it more usable for organizations. Only a handful of DAST vendors build and maintain their own scan engines that are specifically designed to deliver enterprise-grade accuracy and scalability.

Compliance checkbox vs. comprehensive AppSec solution

DAST scanning can now be an explicit compliance requirement in some industries, which leads some organizations to treat it as a mere checklist item. Vendors who specialize in another area of cybersecurity will sometimes offer a low-grade bundled DAST only to tick that box, misrepresenting vulnerability scanning as a mere formality that doesn’t add much (which can also help explain why their DAST didn’t find anything). Running a free tool just to say “we run DAST scans” is another common box-checking practice.

In reality, accurately finding vulnerabilities is only the start for a high-quality DAST solution and the impact it can have on your overall security posture. Being technology-agnostic, DAST is the only part of your application security program that works both for AppSec and InfoSec. When integrated into your systems and workflows, a comprehensive DAST platform can help you improve software security, remove security testing bottlenecks, streamline compliance, and make security a routine aspect of software quality.

Uses and applications for DAST scanners

One unique advantage that DAST solutions enjoy compared to other application security testing tools is their flexibility. DAST use cases include:

 

• Automated penetration testing: When properly set up and integrated into your DevOps process, a DAST scanner can serve as an in-house automated pentester to catch runtime vulnerabilities across your staging and production environments.
• Continuous application security posture management: Being technology-agnostic, a quality DAST solution can probe your real-world web attack surface in a continuous process to find gaps for remediation before they can lead to a data breach or worse.
• Dynamic security testing in the SDLC: Running an accurate and deeply integrated DAST tool as an automated part of your CI/CD pipeline helps development teams fix more security bugs earlier in the software development lifecycle and move their DevOps process towards a DevSecOps model.
• API security testing: Advanced DAST tools can also test API endpoints, automating a vital aspect of security that used to be mostly manual. As the only AppSec tool vendor, Invicti combines API discovery and security testing on a single platform.
• Compliance and risk management: Use DAST to meet regulatory, industry, and internal compliance and audit requirements by generating web vulnerability scan reports scoped for specific needs and audiences. Invicti DAST even includes ML-powered Predictive Risk Scoring to aid risk-based prioritization.

How to choose the best DAST scanner for your web applications and APIs

Perhaps more than with any other type of application security testing tool, selecting a DAST scanner requires due diligence to meet your security, business, and compliance goals. When evaluating DAST scanners, consider at a minimum the following aspects and features: 

• Scan quality: Ensure the DAST tool can test a variety of web technologies and detect all common vulnerability types while also minimizing false positives. The scanner should incorporate a full modern browser engine to ensure thorough crawling and testing, especially for JavaScript-heavy applications.
• Scan performance: Look for scanning tools that can crawl and test applications quickly but also thoroughly. Support for automated authentication is a must for any modern DAST scanner that is used to scan business applications. 
• Flexible deployment: Choose a DAST solution that supports cloud, on-premises, or hybrid deployment models to match changing business needs. Ensure the vendor provides reliable customer support to help with integration, onboarding, and training.

• Additional AppSec features: Opt for scanners that combine a high-quality scan engine with additional features to offer an AppSec platform that goes beyond dynamic security testing alone. Valuable additions include asset discovery, API security, interactive application security testing (IAST), software composition analysis (SCA) to flag vulnerable dependencies, and outdated tech stack detection.
• SDLC integration: Select a DAST scanner that can integrate into your CI/CD pipelines to catch runtime vulnerabilities early and help deliver more secure code. Ensure compatibility with your existing SDLC tools, issue trackers, and communication platforms to smoothly build the tool into development workflows.
• Automation: Ideally, a DAST tool in your SDLC should automatically run at predefined points, deliver clear and actionable tickets to developers, and retest fixes to ensure their effectiveness. Ensure that automated vulnerability reports are accurate to take the load off your security teams.
• Reporting: Look for vulnerability reporting capabilities that match your business needs. A mature DAST scanner will offer a variety of report types, dashboards, and vulnerability management features.

For detailed information on how to evaluate DAST scanners, see Invicti’s free Web Application Security Buyer’s Guide.

---

Frequently asked questions