Prevent costly breaches and malicious attacks with dynamic analysis. Our AI-powered DAST scans live applications and APIs for vulnerabilities early in the development lifecycle—before they reach production.
By incorporating automated DAST at any stage of the development cycle, you can address the most complex applications, assess risks and help manage and resolve vulnerabilities with more precision, and in less time.
DAST for Developers
DAST for Developers
DAST offers pre-configured workflows, test optimization, targeted scans on specific endpoints, and incremental scanning—ideal for developers integrating security into IDEs, CI/CD pipelines, and DTS tools. With plugins for Jenkins, Azure DevOps, GitHub and more, developers can validate fixes, correlate findings, and confidently promote secure code to the main branch.
HCL AppScan DAST provides developers with the ability to look at specific activity traffic as well as ratify and correlate security findings. Its Unit-level DAST Intelligence Tester (AUDIT) supports targeted scans on specific endpoints, so that developers can perform early vulnerability detection and run lightweight scans directly within the IDE during development.
Web API Scanning
Web API Scanning
Expand your vulnerability coverage with automated scanning of all web APIs—using Postman collection files, OpenAPI descriptions, recorded traffic, or through HCL AppScan's seamless integration with leading API testing tools.
IFA for DAST
IFA for DAST
Leverage AI for improved DAST scan speed and accuracy with Intelligent Findings Analytics (IFA). IFA incorporates GenAI to detect and validate error pages more effectively, reducing false positives and uncovering hidden vulnerabilities.
The IFA Test Optimization feature allows users to adjust scan speed and depth based on development needs with four optimization levels. Choose to go 10x faster with 70% accuracy, or only 2x faster with 97% accuracy. Your choice!
Incremental and Action-based Scanning
Incremental and Action-based Scanning
Incremental scanning saves time by limiting testing to only new portions of the source code, or portions with issues found in earlier scans.
Action-based scanning uses an embedded browser to explore/crawl the application as a user would – providing a user-view of the application, rather than a traditional traffic view.
Vulnerable Third-Party Component Detection
Vulnerable Third-Party Component Detection
Hackers target well-known vulnerabilities in popular libraries that you may have incorporated into your application. DAST together with vulnerable third-party component detection provide you with much more comprehensive vulnerability coverage, allowing you to identify (fingerprint) third-party libraries with known vulnerabilities and see those findings alongside all your DAST results.
OWASP Top 10 & OWASP API Security Top 10
OWASP Top 10 & OWASP API Security Top 10
The OWASP Foundation spearheads community-led, open-source projects to study and provide guidance in application security. HCL AppScan DAST technology contributes to our ability to offer 100% coverage for the most common vulnerabilities and security risks on both important benchmarks.
User Defined Tests
Create your own custom user rules to identify application specific issues or errors. You can examine traffic for unwanted content or behavior, create payloads and search for reflected behavior that indicates a problem, and even validate with external servers for known blind attacks.
Multi-Step Operations
Recorded multi-step and action-based multi-step operations enable testing of complex logical sequences in the application. Whenever a complex series of work needs to be accomplished before testing a particular page in a particular state, the sequence can be replayed to be in the correct state.
HCL AppScan Domain Name Server (ADNS)
Uncover non-reflected vulnerabilities using DAST by leveraging ADNS. Vulnerabilities such as remote command execution are difficult to find using standard DAST techniques. By leveraging ADNS and attempting to resolve one-off domains, we can detect even those undetectable issues.
Cross-Site Scripting (XSS) Analyzer
XSS analyzer is the world’s only systematic XSS detection module. Representing 500 million (!!) payload options, a cross-sites scripting vulnerability can be confirmed or discounted with an average of only 17 tests with nearly 100% accuracy!
Security and Compliance Reports
Generate XML & CSV reports for sharing with external tools. Create PDF or HTML reports to share with development teams or other security analysts. Create dozens of compliance and industry-standard reports.
Privilege Escalation
Test application role-based access and permissions using HCL AppScan’s Privilege Escalation component. Using scans from two or more different roles, HCL AppScan generates a report of all access control errors from lower permission users to restricted locations of the application.
Third-Party and Infrastructure Tests
Your code relies on third-party libraries and components. Test those with the 1000s of available CVE (Common Vulnerabilities and Exposures) tests, as well as with infrastructure tests that check your server configuration, SSL/TLS channels, and more.
Featured Resources
Wider Application Security Coverage with HCL AppScan DAST and Vulnerable Third-Party Component Detection
