Dynamic Application Security Testing Tools
Dynamic Application Security Testing (DAST) tools for dynamic application security testing that identify vulnerabilities in running web applications and APIs through automated scanning.
Browse 92 dynamic application security testing tools
FEATURED
USE CASES
A toolkit for detecting and tracking Blind XSS, XXE, and SSRF vulnerabilities
InQL is a Burp Suite extension for advanced GraphQL testing and vulnerability detection
A web security tool that scans for vulnerabilities and known attacks.
A comprehensive web application security testing solution that offers built-in vulnerability assessment and management, as well as integration options with popular software development tools.
Web-application vulnerability scanner with extensive coverage of security testing modules.
A Java based HTTP/HTTPS proxy for assessing web application vulnerability with various useful features.
ZAP is an open-source web application security scanner that helps identify vulnerabilities through automated scanning and manual testing capabilities.
Container image definitions that create standardized testing environments for software applications with consistent dependencies and configurations.
IronBee is an open source web application security sensor framework that provides detection and prevention capabilities for web application vulnerabilities.
Introspy-Android is a dynamic analysis framework that hooks Android APIs at runtime to monitor application behavior and identify security vulnerabilities on rooted devices.
DOMPurify is a fast XSS sanitizer for HTML, MathML, and SVG.
A collection of Yara rules for the Burp Yara-Scanner extension that helps identify malicious software and infected web pages during web application security assessments.
w3af is an open source web application security scanner that identifies over 200 types of vulnerabilities including XSS, SQL injection, and OS commanding in web applications.
CakeFuzzer is an automated vulnerability discovery tool specifically designed for identifying security issues in CakePHP web applications with minimal false positives.
A Python-based Burp Suite extension that integrates Yara scanning capabilities for detecting patterns and signatures in web application traffic using custom Yara rules.
ConDroid is a concolic execution framework for Android applications that automates dynamic analysis by driving execution to specific code locations without manual interaction.
A plugin for viewing, detecting weak configurations, and generating Content Security Policy headers.
Python tool for monitoring user-select APIs in Android apps using Frida.
A comprehensive toolkit for web application security testing, offering a range of products and solutions for identifying vulnerabilities and improving security posture.
Articles About Dynamic Application Security Testing
Tool roundups, buying guides, and strategic analysis from the CybersecTools resource library.
Dynamic Application Security Testing Tools FAQ
Common questions about Dynamic Application Security Testing tools, selection guides, pricing, and comparisons.
Use SAST during development to catch coding flaws early (SQL injection, XSS patterns in code). Use DAST to test running applications for runtime vulnerabilities that SAST cannot detect: authentication issues, session management flaws, server misconfigurations, and business logic vulnerabilities. A mature AppSec program uses both, with SAST in CI/CD and DAST in staging/pre-production.
