DAST Scanner Skill

Overview

Dynamic Application Security Testing (DAST) skill for detecting runtime vulnerabilities by testing running applications. Unlike SAST (static analysis), DAST identifies issues in deployed environments through actual HTTP requests and responses.

Capabilities

1. Runtime Vulnerability Detection

• SQL Injection: Test actual database queries
• XSS (Reflected & Stored): Inject payloads in running app
• Authentication Bypass: Test login mechanisms
• Broken Access Control: Verify authorization
• Security Misconfiguration: Detect exposed endpoints
• CSRF: Test cross-site request forgery protection
• Clickjacking: Check X-Frame-Options headers

2. API Security Testing

• REST API endpoint discovery
• GraphQL introspection testing
• Authentication token validation
• Rate limiting verification
• Input validation testing

3. Web Application Scanning

• Automated crawling
• Form submission testing
• Session management analysis
• SSL/TLS configuration check
• Security header validation

Tools Integration

StackHawk (Primary - AI-Friendly)

CLI-first DAST tool with Claude Code integration:

# Install StackHawk
npm install -g @stackhawk/cli

# Initialize configuration
hawk init

# Run scan
hawk scan stackhawk.yml

OWASP ZAP (Open Source)

Comprehensive security scanner:

# Run ZAP in daemon mode
docker run -u zap -p 8080:8080 \
  -v $(pwd):/zap/wrk/:rw \
  owasp/zap2docker-stable \
  zap.sh -daemon -port 8080 -host 0.0.0.0 -config api.disablekey=true

# Spider + active scan
zap-cli quick-scan --self-contained --start-options '-config api.disablekey=true' \
  http://localhost:3000

Burp Suite

Professional web vulnerability scanner:

• Manual testing with Proxy
• Active/Passive scanning
• Intruder for fuzzing
• Repeater for payload testing

DAST Workflow

1. Environment Setup

# Start application in test environment
docker-compose -f docker-compose.test.yml up -d

# Wait for application to be ready
./wait-for-it.sh localhost:3000 --timeout=60

2. Run Scan

# StackHawk scan
hawk scan stackhawk.yml

# Or OWASP ZAP
zap-cli spider http://localhost:3000
zap-cli active-scan http://localhost:3000
zap-cli report -o zap-report.html -f html

3. Analyze Results

# Parse findings
python analyze_dast_results.py zap-report.json

Configuration Examples

StackHawk Configuration (stackhawk.yml)

app:
  applicationId: ${APP_ID}
  env: Development
  host: http://localhost:3000

hawk:
  spider:
    base: true
    maxDuration: 5

  # Authentication
  authentication:
    type: form
    loginPath: /login
    loginForm:
      usernameField: email
      passwordField: password
    testCredentials:
      username: ${TEST_USER}
      password: ${TEST_PASSWORD}

  # Custom headers
  http:
    headers:
      - name: Authorization
        value: Bearer ${AUTH_TOKEN}

  # Include/Exclude paths
  spider:
    include:
      - /api/.*
    exclude:
      - /logout
      - /admin/.*

OWASP ZAP Configuration (zap-config.yaml)

env:
  contexts:
    - name: webapp
      urls:
        - http://localhost:3000
      includePaths:
        - http://localhost:3000/api/.*
      excludePaths:
        - http://localhost:3000/logout
      authentication:
        method: formBased
        parameters:
          loginUrl: http://localhost:3000/login
          loginRequestData: username={%username%}&password={%password%}
        verification:
          method: response
          loggedInRegex: "\\QWelcome\\E"

Integration Scripts

dast_scan.sh

Automated DAST scanning:

#!/bin/bash
# Run comprehensive DAST scan

APP_URL=${1:-http://localhost:3000}
REPORT_DIR="security-reports/dast"
mkdir -p $REPORT_DIR

echo "=== Starting DAST Scan ==="
echo "Target: $APP_URL"

# 1. Check if app is running
if ! curl -s -o /dev/null -w "%{http_code}" $APP_URL | grep -q "200\|302"; then
    echo "❌ Application not reachable at $APP_URL"
    exit 1
fi

echo "✓ Application is running"

# 2. Run StackHawk scan
if command -v hawk &> /dev/null; then
    echo "Running StackHawk scan..."
    hawk scan stackhawk.yml --api-key $STACKHAWK_API_KEY
fi

# 3. Run OWASP ZAP scan
if command -v zap-cli &> /dev/null; then
    echo "Running OWASP ZAP scan..."
    zap-cli quick-scan --self-contained \
      --spider \
      --ajax-spider \
      --active-scan \
      -o $REPORT_DIR/zap-report.html \
      $APP_URL
fi

# 4. Check for common security headers
echo "Checking security headers..."
./check_security_headers.sh $APP_URL > $REPORT_DIR/headers.txt

echo "=== DAST Scan Complete ==="
echo "Reports: $REPORT_DIR/"

check_security_headers.sh

Validate security headers:

#!/bin/bash
# Check critical security headers

URL=$1

echo "=== Security Headers Check ==="
echo "Target: $URL"
echo

HEADERS=$(curl -s -I $URL)

# Check required headers
check_header() {
    local header=$1
    local expected=$2

    if echo "$HEADERS" | grep -qi "^$header:"; then
        value=$(echo "$HEADERS" | grep -i "^$header:" | cut -d' ' -f2-)
        echo "✓ $header: $value"
    else
        echo "✗ $header: MISSING"
        echo "  💡 Add header: $expected"
    fi
}

check_header "Content-Security-Policy" "default-src 'self'"
check_header "X-Frame-Options" "DENY or SAMEORIGIN"
check_header "X-Content-Type-Options" "nosniff"
check_header "Strict-Transport-Security" "max-age=31536000"
check_header "X-XSS-Protection" "1; mode=block"
check_header "Referrer-Policy" "no-referrer-when-downgrade"
check_header "Permissions-Policy" "geolocation=(), microphone=()"

# Check for insecure headers
echo
echo "=== Insecure Headers Check ==="

if echo "$HEADERS" | grep -qi "Server:"; then
    server=$(echo "$HEADERS" | grep -i "Server:" | cut -d' ' -f2-)
    echo "⚠️  Server: $server (leaks server version)"
fi

if echo "$HEADERS" | grep -qi "X-Powered-By:"; then
    powered=$(echo "$HEADERS" | grep -i "X-Powered-By:" | cut -d' ' -f2-)
    echo "⚠️  X-Powered-By: $powered (leaks framework version)"
fi

analyze_dast_results.py

Parse and prioritize findings:

#!/usr/bin/env python3
import json
import sys
from collections import defaultdict

def analyze_zap_results(json_file):
    """Analyze OWASP ZAP results"""
    with open(json_file) as f:
        data = json.load(f)

    alerts = data.get('site', [{}])[0].get('alerts', [])

    # Group by risk
    findings = defaultdict(list)
    for alert in alerts:
        risk = alert.get('riskdesc', 'Unknown').split()[0]  # "High (Medium)" -> "High"
        findings[risk].append({
            'name': alert.get('name'),
            'count': len(alert.get('instances', [])),
            'description': alert.get('desc', ''),
            'solution': alert.get('solution', ''),
            'urls': [inst.get('uri') for inst in alert.get('instances', [])[:3]]
        })

    print("=== DAST Vulnerability Summary ===\n")

    for risk in ['High', 'Medium', 'Low', 'Informational']:
        if risk in findings:
            print(f"\n{risk} Risk: {len(findings[risk])} issues")
            for finding in findings[risk]:
                print(f"\n  • {finding['name']} ({finding['count']} instances)")
                print(f"    {finding['description'][:100]}...")
                print(f"    💡 {finding['solution'][:100]}...")
                for url in finding['urls'][:2]:
                    print(f"    🔗 {url}")

    # Calculate score
    score = len(findings['High']) * 20 + len(findings['Medium']) * 10 + len(findings['Low']) * 5
    print(f"\n=== Security Score: {max(0, 100 - score)}/100 ===")

if __name__ == '__main__':
    analyze_zap_results(sys.argv[1])

Common Vulnerabilities Found by DAST

1. SQL Injection (Runtime)

# Test payload
curl "http://localhost:3000/api/users?id=1' OR '1'='1"

# Expected: 400 Bad Request (blocked)
# Vulnerable: 200 OK with all users

2. XSS (Reflected)

# Test payload
curl "http://localhost:3000/search?q=<script>alert('XSS')</script>"

# Expected: Escaped output or CSP block
# Vulnerable: Script executes

3. Authentication Bypass

# Test without credentials
curl http://localhost:3000/api/admin/users

# Expected: 401 Unauthorized
# Vulnerable: 200 OK with data

4. Missing Security Headers

# Check headers
curl -I http://localhost:3000

# Should include:
# - Content-Security-Policy
# - X-Frame-Options
# - X-Content-Type-Options

CI/CD Integration

GitHub Actions

name: DAST Scan

on:
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM
  workflow_dispatch:

jobs:
  dast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Start application
        run: docker-compose -f docker-compose.test.yml up -d

      - name: Wait for app
        run: ./wait-for-it.sh localhost:3000 --timeout=60

      - name: Run StackHawk scan
        uses: stackhawk/hawkscan-action@v2
        with:
          apiKey: ${{ secrets.HAWK_API_KEY }}
          configurationFiles: stackhawk.yml

      - name: Upload results
        uses: actions/upload-artifact@v3
        with:
          name: dast-results
          path: stackhawk-output/

Best Practices

1. Test in Staging: Never run DAST on production
2. Authenticated Scanning: Test with valid user sessions
3. Rate Limiting: Don't overwhelm the application
4. Combine with SAST: Use both static and dynamic analysis
5. Regular Scans: Schedule daily or weekly scans
6. API Testing: Include API endpoints in scope
7. False Positives: Verify findings manually
8. Scope Control: Exclude logout, delete actions

Security Headers Checklist

✓ Content-Security-Policy: default-src 'self'
✓ X-Frame-Options: DENY
✓ X-Content-Type-Options: nosniff
✓ Strict-Transport-Security: max-age=31536000; includeSubDomains
✓ X-XSS-Protection: 1; mode=block
✓ Referrer-Policy: strict-origin-when-cross-origin
✓ Permissions-Policy: geolocation=(), microphone=(), camera=()
✗ Server: (remove to hide server version)
✗ X-Powered-By: (remove to hide framework)

Requirements

# StackHawk
npm install -g @stackhawk/cli

# OWASP ZAP
pip install zaproxy
# Or: docker pull owasp/zap2docker-stable

# Burp Suite
# Download from: https://portswigger.net/burp

Metrics to Track

• Critical findings: Fix immediately
• Scan coverage: % of application tested
• False positive rate: < 10%
• Time to remediate: Days to fix issues
• Scan frequency: Daily recommended
• API coverage: 100% of endpoints