Astra Security DAST Scanner

Astra DAST Scanner is a dynamic application security testing tool designed for engineering and DevSecOps teams. It performs automated web application and API security scanning using a library of 15,000+ test cases covering standards such as OWASP Top 10, ASVS, NIST, and SANS, as well as known CVEs and complex vulnerability classes including XSS, SQLi, IDOR, CSRF, and SSRF. The scanner supports authenticated scanning behind login forms, including TOTP-based MFA (e.g., Google Authenticator, Authy), static OTPs, and manual auth headers. It includes a secret scanning module that detects exposed API keys, access tokens, and credentials, with support for custom detection rules and false positive suppression. API security scanning covers REST, SOAP, and GraphQL APIs, with a browser-based crawling engine for JavaScript-heavy applications and automatic API inventory creation. AI-driven contextual analysis tailors test scenarios to individual applications and provides remediation guidance. Continuous scanning is supported via CI/CD pipeline integration, with scheduling, post-deployment triggers, and role-based access control (RBAC). Vulnerability results are noise-filtered, with optional expert vetting by security engineers. Automated rescanning allows targeted retesting of fixed vulnerabilities without full scan cycles. Compliance mapping covers ISO 27001, HIPAA, SOC2, and GDPR. A Trust Center feature lets teams share a public security posture dashboard with customers and partners. Reports are exportable in PDF, CSV, and JSON formats, targeting engineering, management, and external stakeholders.