DAST Tooling Standard

Priority: P1 (HIGH)

Always-Apply Rules

• No Scanning Production: Never run DAST tools against live production environments. Use local or staging replicas only.
• No Uncapped Scans: Always set max-depth or max-duration to avoid infinite loops on dynamic routes.
• No Anonymous Probing: Use authenticated headers (Authorization) to test protected surfaces, not public ones.
• No Mobile on Real Devices in Prod: Use emulators/simulators for mobile interception testing.
• Authorization & Finite Bounds ([DAST-AUTH-01]): Dynamic scanning requires explicit target authorization, finite runtime/payload caps, and cancellation. Missing authorization or bounds BLOCKS dependent active execution (status: BLOCKED); offline planning continues; agents cannot self-authorize.

1. Backend / API Tools

Scanner Tools

See implementation guide for setup commands.

• Nuclei: Fast, template-based CVE/misconfiguration scanning.
• ZAP-CLI: Deep spidering for SQLi, XSS, CSRF, session issues.
• Nikto: Server configuration audit (version disclosure, headers).
• sqlmap: Automated SQL injection detection and exploitation (suggest only, human confirms).
• ffuf / feroxbuster: Content discovery and parameter enumeration; does not replace structured robustness/fuzz testing (see quality-engineering-api-fuzz-testing).

API-Specific Probing

• GraphQL: Introspection query, nested query depth attack, field suggestion enumeration.
• gRPC: grpcurl for service enumeration and method probing.
• WebSocket: Connection hijacking, message injection testing.

2. Frontend / Web Tools