This integration is configured through the Invicti ASPM product.
DAST overview
What is DAST?
Dynamic Application Security Testing (DAST) identifies security vulnerabilities in running web applications, web services, and APIs. It operates as a black-box scanner, testing applications from the outside without requiring access to source code, making it technology-agnostic regardless of the programming language, framework, or platform used.
Invicti AppSec Core includes a preconfigured Invicti SCA scanner that is automatically activated with your package. The integrations on this page are for teams using Invicti ASPM who want to connect their own SCA tools instead. See AppSec Core scanners overview for details on the built-in scanner.
How it works
DAST scanners typically operate in four stages:
1. Crawling The scanner maps the attack surface of the target application by behaving like a real user — visiting links, clicking buttons, submitting forms, and parsing API definitions (WSDL, WADL, OpenAPI/Swagger) to build a list of all potential attack vectors.
2. Attacking The scanner sends attack payloads to each discovered input point and analyzes responses for vulnerability patterns. This involves detection, confirmation, and — in more advanced tools — proof generation that safely exploits confirmed vulnerabilities in a read-only manner.
3. Recrawling The scanner revisits the application after the attacking stage, as new pages or states may have been uncovered during testing. This step is critical for detecting stored XSS and second-order vulnerabilities.
4. Late confirmation Handles time-sensitive vulnerabilities such as Blind SQL Injection (which requires delayed responses) and out-of-band vulnerabilities.
What it can discover
DAST detects vulnerabilities across the following categories:
| Category | Examples |
|---|---|
| Injection | SQL Injection, NoSQL Injection, Command Injection, LDAP Injection, XXE Injection, Server-Side Template Injection |
| Cross-Site Scripting (XSS) | Reflected XSS, Stored XSS, DOM-based XSS |
| Remote code execution | RCE, Local File Inclusion, Remote File Inclusion, Directory Traversal |
| Server-Side Request Forgery | SSRF |
| Authentication and session | Authentication flaws, Session fixation, Cookieless session state |
| Security misconfigurations | Debug modes enabled, Mixed content over HTTPS, Unsafe CSP directives, Version disclosure |
| Known vulnerabilities | Outdated libraries, Log4Shell, and other CVEs in third-party components |
DAST integrations support reporting against OWASP Top Ten 2021 and OWASP API Security Top Ten 2023.
Supported DAST and API scanners
The following DAST and API integrations are available through Invicti ASPM:
| Scanner | Type | Authentication |
|---|---|---|
| Invicti Enterprise | Connection | API token |
| Invicti Platform | Connection | API token |
| Burp Suite | Connection | API token |
| Burp Suite Enterprise | Connection | API token |
| Acunetix 360 | Connection | API token |
| Acunetix Premium | Connection | API token |
| HCL AppScan Enterprise | Connection | Basic auth |
| HCL AppScan Standard | Connection | Basic auth |
| Fortify WebInspect | Connection | Basic auth |
| Fortify on Demand DAST | Connection | Basic auth |
| Qualys WAS | Connection | API token |
| Rapid7 InsightAppSec | Connection | API token |
| Tenable.io WAS | Connection | API token |
| Veracode DAST | Connection | API ID + key |
| AppSpider Pro | Connection | Basic auth |
| Salt Security | Connection | API token |
| Akto | Connection | API token |
| Nuclei | Docker | — |
| OWASP ZAP | Docker | — |
| OWASP ZAP Headless | Docker | — |
Choosing a DAST scanner
| If you need… | Consider |
|---|---|
| Enterprise-grade DAST with proof-based scanning | Invicti Enterprise, Invicti Platform |
| Manual + automated hybrid testing | Burp Suite, Burp Suite Enterprise |
| SaaS-only, no infrastructure | Acunetix 360, Fortify on Demand, Rapid7 InsightAppSec, Veracode DAST |
| Open-source / no license cost | OWASP ZAP, Nuclei |
| API-first testing | Akto, Salt Security |
| VM-based enterprise deployments | HCL AppScan Enterprise, HCL AppScan Standard, Fortify WebInspect |
Need help?
Invicti Support team is ready to provide you with technical help. Go to Help Center