Skip to main content

DAST Essentials target configuration

On the Configure target page in DAST Essentials, you can configure in-depth settings for further fine-tuning your security scan. Especially the automation part is where you can use DAST Essentials to the fullest extent and get started on your continuous security testing journey (also referred to as "DevSecOps").

Authentication​

If your system is protected by authentication, you can specify the needed authentication to access the system.

System Authentication​

If HTTP basic authentication, or .htaccess protection, is enabled, configure the credentials here.

Application Authentication​

If your application has a login form, you may add credentials here. This only works for Multi-Page Applications.

Parameter Authentication​

This setting allows you to configure HTTP headers, GET parameters, or session cookies for authentication. You might use this authentication for scanning an API.

DAST Essentials authentication methods describes more advanced authentication flows such as SAML and OAuth2.

Automation​

This setting is where you reap the benefits of automated pentesting - starting a security scan automatically by time or event.

Scheduled Scan​

Configure a daily or weekly schedule so that your scans are started automatically at a particular time, day or week.

Webhook​

Create a webhook so your build system can start a security scan automatically based on your needs. Following these steps, you can easily integrate it into your CI/CD pipeline.

Notification​

Enter a Slack webhook so that DAST Essentials can notify you every time a scan has finished. More information on the creation of Slack webhooks can be found here.

Crawler Mode & Throttling​

Crawling method​

Adjust the crawler mode to define whether the smart crawling should try to detect forms that appear on multiple sites and only scan them once to reduce the scan duration.
You can choose between the following crawling methods:

  • The Smart Crawling mode tries to detect forms that appear on multiple sites (e.g. a search form) and only scans them once to reduce the scan duration. Depending on the implementation of your web application, this might reduce the scan coverage if an identical form appears on multiple sites but is processed differently. Choose the exhaustive crawling if this is the case.
  • The Exhaustive Crawling mode scans each detected form for vulnerabilities. Therefore, forms appearing on multiple sites are scanned each time individually. This might significantly increase the scan duration but can increase the detection rate.

Throttling​

Adjust the throttling threshold to limit the maximum number of requests per second sent to scan your server. Consider that the threshold influences the scan duration and that certain scanners require a minimum threshold.