DAST

Dynamic Application Security Testing

Probe a running application from the outside, the way an attacker would.

34 tools profiled

How it differs Tests the running application from the outside, with no access to source. SAST never runs the app; IAST instruments it from the inside.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals

34 tools

  • Nikto

    Chris Sullo and contributors

    DAST

    Perl command line scanner that checks a web server against a large database of known dangerous files, outdated software banners and misconfigurations.

    Open source
    Established Verified

  • Rapid7 InsightAppSec

    Rapid7

    DAST

    Cloud-managed dynamic scanner that crawls and attacks web applications through distributed engines, with replayable proof steps for each finding.

    Commercial
    Established

  • Fluid Attacks

    Fluid Attacks

    DAST

    Continuous security testing service combining automated scanners with a standing team of testers, delivered through a shared platform with a build gate.

    Commercial
    Growing

  • Caido

    Caido Labs

    DAST

    Web security testing proxy built around a separate client and server, with a query language for filtering traffic and a plugin system for automation.

    Not recorded
    Growing

  • AppTrana

    Indusface

    DAST

    Managed web application and API protection platform that pairs dynamic scanning with a WAF, using scan findings to drive virtual patch rules.

    Commercial
    Established

  • Nikto

    Chris Sullo and contributors

    Perl command line scanner that checks a web server against a large database of known dangerous files, outdated software banners and misconfigurations.

    Open source Established
    DAST

  • Rapid7 InsightAppSec

    Rapid7

    Cloud-managed dynamic scanner that crawls and attacks web applications through distributed engines, with replayable proof steps for each finding.

    Commercial Established
    DAST

  • Fluid Attacks

    Fluid Attacks

    Continuous security testing service combining automated scanners with a standing team of testers, delivered through a shared platform with a build gate.

    Commercial Growing
    DAST

  • Caido

    Caido Labs

    Web security testing proxy built around a separate client and server, with a query language for filtering traffic and a plugin system for automation.

    Not recorded Growing
    DAST

  • AppTrana

    Indusface

    Managed web application and API protection platform that pairs dynamic scanning with a WAF, using scan findings to drive virtual patch rules.

    Commercial Established
    DAST

  • Pentest Tools

    Pentest-Tools.com

    DAST

    Hosted platform that packages web and network scanners behind one interface, with chained scan automation and report generation.

    Commercial
    Growing

  • HCL AppScan

    HCLSoftware

    DAST

    Long established enterprise application security suite whose dynamic scanner crawls and audits running applications with heavy scan configuration options.

    Commercial
    Established

  • Burp Suite

    PortSwigger

    DAST

    Intercepting proxy and testing toolkit that puts a human in the request path, with an automated scanner and an extension ecosystem around it.

    Freemium
    Established Verified

  • Acunetix

    Invicti Security

    DAST

    Commercial dynamic application security scanner that crawls web apps with a headless browser engine and confirms many injection findings by exploiting them.

    Commercial
    Established

  • Bright Security

    Bright Security

    DAST

    Developer oriented dynamic scanner for web apps and APIs that validates each finding before reporting it, designed to run on every build.

    Freemium
    Growing

  • Pentest Tools

    Pentest-Tools.com

    Hosted platform that packages web and network scanners behind one interface, with chained scan automation and report generation.

    Commercial Growing
    DAST

  • HCL AppScan

    HCLSoftware

    Long established enterprise application security suite whose dynamic scanner crawls and audits running applications with heavy scan configuration options.

    Commercial Established
    DAST

  • Burp Suite

    PortSwigger

    Intercepting proxy and testing toolkit that puts a human in the request path, with an automated scanner and an extension ecosystem around it.

    Freemium Established
    DAST

  • Acunetix

    Invicti Security

    Commercial dynamic application security scanner that crawls web apps with a headless browser engine and confirms many injection findings by exploiting them.

    Commercial Established
    DAST

  • Bright Security

    Bright Security

    Developer oriented dynamic scanner for web apps and APIs that validates each finding before reporting it, designed to run on every build.

    Freemium Growing
    DAST
Tick up to 4 tools above.