common-dast-tooling

DAST Tooling Standard

Priority: P1 (HIGH)

Always-Apply Rules

• No Scanning Production: Never run DAST tools against live production environments. Use local or staging replicas only.
• No Uncapped Scans: Always set max-depth or max-duration to avoid infinite loops on dynamic routes.
• No Anonymous Probing: Use authenticated headers (Authorization) to test protected surfaces, not public ones.
• No Mobile on Real Devices in Prod: Use emulators/simulators for mobile interception testing.

1. Backend / API Tools

Scanner Tools

See implementation guide for setup commands.

• Nuclei: Fast, template-based CVE/misconfiguration scanning.
• ZAP-CLI: Deep spidering for SQLi, XSS, CSRF, session issues.
• Nikto: Server configuration audit (version disclosure, headers).
• sqlmap: Automated SQL injection detection and exploitation (suggest only — human confirms).
• ffuf / feroxbuster: Content discovery and endpoint fuzzing.

API-Specific Probing

• GraphQL: Introspection query, nested query depth attack, field suggestion enumeration.
• gRPC: grpcurl for service enumeration and method probing.
• WebSocket: Connection hijacking, message injection testing.

2. Frontend / Web Tools

• Browser DevTools: Network tab for auth token leakage, console for client-side errors.
• Playwright/Puppeteer (suggested): Automated DOM XSS detection, form submission, CSRF testing.
• Lighthouse: Security/performance audit (CSP, HTTPS, mixed content).
• CSP Evaluator: Validate Content-Security-Policy headers.

3. Mobile Interception Tools

• mitmproxy / Burp Suite: Proxy mobile traffic for API inspection.
• Frida: Runtime instrumentation for cert pin bypass, biometric bypass, jailbreak detection bypass.
• adb / xcrun simctl: Device-level inspection, deep link testing, storage extraction.
• Objection: Mobile runtime exploration (iOS/Android).

4. AI-Driven curl Probing (Manual Fallback)

When automated tools unavailable, generate targeted curl probes:

• Bypassing Guards: Probe with manipulated headers (X-Forwarded-For, X-Custom-Auth).
• Data Leakage: Request /metrics, /health, .git, /.env, /api-docs.
• Parameter Tampering: Modify payload types (String→Object), inject large payloads.
• JWT Manipulation: Test with expired token, no token, modified claims.

See implementation guide for all commands.

Scoring Impact

Finding	Severity	Deduction
Unauthenticated access to private data	P0	-25
Successful SQLi/RCE via probe	P0	-20
Mobile API interception (no cert pin)	P1	-15
DOM XSS confirmed via browser	P1	-10
Info Leakage (Server versions/Env vars)	P1	-10
Missing security headers (CSP/HSTS)	P2	-5

Anti-Patterns

• No relying solely on static analysis: Pentesting MUST include dynamic execution feedback.
• No ignoring non-web protocols: Check Docker ports, SSH banners, gRPC/RMQ listeners.
• No skipping mobile: If mobile app exists, proxy its traffic and inspect API calls.

References

• DAST Tooling Implementation
• OWASP Dynamic Scanning Guide