Aikido DAST Scanner

Aikido DAST Scanner is a dynamic application security testing tool that scans web applications to identify vulnerabilities and security exposures. The scanner performs automated daily scans of front-end applications to detect common security issues and misconfigurations.

The tool includes automated API discovery and security scanning capabilities for REST and GraphQL endpoints, generating updated Swagger documentation and OpenAPI specifications. It uses a Nuclei-based scanner to check self-hosted applications including WordPress, GitLab, Jira, Drupal, Joomla, Laravel, Magento, Prestashop, Grafana, WooCommerce, and Nginx for known vulnerabilities.

The scanner supports authenticated DAST testing, allowing it to log in as a user to test for vulnerabilities accessible to authenticated users, including JWT token security. It scans for dangling domains by checking DNS records to identify subdomains pointing to inactive services that could be vulnerable to takeover.

The tool identifies toxic combinations where multiple vulnerabilities combine to create critical security threats. Scan results are translated into actionable advice with human-readable explanations of security issues and remediation guidance. Notifications can be sent through multiple channels including email and Slack when new vulnerabilities are discovered.