Skip to main content

DAST — getting started

DAST actively tests your web applications — it sends real payloads (fuzzing and injection-class checks) to find SQLi, XSS, RCE, SSRF, SSTI and similar flaws that only show up when you actually probe an app.

Unlike EASM (which observes), DAST is intrusive by design, so it has two rules you should know up front:

  1. DAST tests only the web apps EASM already discovered — never an arbitrary URL you type in. This keeps testing scoped to surface you own.
  2. DAST never starts on its own. Running EASM feeds DAST the list of web apps, but you must explicitly trigger the DAST scan.

The flow​

Run EASM (discovers web apps)  →  Review the DAST surface  →  Run DAST  →  Review findings

1. Run EASM first​

DAST consumes EASM's output. Every EASM scan promotes the web apps it found into your DAST surface (the list of apps eligible for active testing). If you've never run EASM, do that first — without a surface, DAST has nothing to test and will be blocked.

2. Check the surface​

Open the DAST surface to see the discovered web apps and whether DAST can run. If it's empty, run (or re-run) EASM.

3. Run DAST​

Click Run DAST. It crawls each discovered app into a wide set of URLs and parameters, then runs the active fuzzing and injection-class checks over them. The crawl is bounded — limited depth, concurrency, request rate, scope, and a maximum URL count — so it never hammers or wanders off your app. DAST has its own 14-day cooldown, independent of EASM.

4. Review the findings​

DAST findings flow through the same engine as EASM: plain description, risk, four remediation steps, computed severity, grouped by issue, with the same triage and rescan lifecycle. Answer each finding (In Progress / Resolved / Accepted Risk / False Positive), fix it, and rescan to confirm — a Resolved finding closes when the next scan no longer sees it.

Safety summary​

  • Tests only your EASM-discovered surface, only when DAST is enabled for you.
  • The crawl is rate-limited and scope-locked.
  • It's on-demand — you start it; EASM never starts it for you.

Next​

  • New to the platform? Start with the EASM guide — DAST builds on it.
  • Integrating DAST into your own portal? See the EASM API Usage Guide; the DAST endpoints follow the same pattern (POST /org/scans { "module": "dast" }, gated on a non-empty surface).