# Common Dast Tooling

Standardize dynamic application security testing for backend APIs, frontend web apps...

- Repository: https://github.com/HoangNguyen0403/agent-skills-standard (582 stars)
- Category: Design
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling -g -a claude-code -y`
Codex: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling -g -a codex -y`
Cursor: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling -g -a cursor -y`
Gemini CLI: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling -g -a gemini-cli -y`

## Description

Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on local/staging environments.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# DAST Tooling Standard

## **Priority: P1 (HIGH)**

## Always-Apply Rules

- **No Scanning Production**: Never run DAST tools against live production environments. Use local or staging replicas only.
- **No Uncapped Scans**: Always set `max-depth` or `max-duration` to avoid infinite loops on dynamic routes.
- **No Anonymous Probing**: Use authenticated headers (`Authorization`) to test protected surfaces, not public ones.
- **No Mobile on Real Devices in Prod**: Use emulators/simulators for mobile interception testing.
- **Authorization & Finite Bounds (`[DAST-AUTH-01]`)**: Dynamic scanning requires explicit target authorization, finite runtime/payload caps, and cancellation. Missing authorization or bounds BLOCKS dependent active execution (`status: BLOCKED`); offline planning continues; agents cannot self-authorize.

## 1. Backend / API Tools

### Scanner Tools
See [implementation guide](references/implementation.md) for setup commands.

- **Nuclei**: Fast, template-based CVE/misconfiguration scanning.
- **ZAP-CLI**: Deep spidering for SQLi, XSS, CSRF, session issues.
- **Nikto**: Server configuration audit (version disclosure, headers).
- **sqlmap**: Automated SQL injection detection and exploitation (suggest only, human confirms).
- **ffuf / feroxbuster**: Content discovery and parameter enumeration; does not replace structured robustness/fuzz testing (see `quality-engineering-api-fuzz-testing`).

### API-Specific Probing
- **GraphQL**: Introspection query, nested query depth attack, field suggestion enumeration.
- **gRPC**: `grpcurl` for service enumeration and method probing.
- **WebSocket**: Connection hijacking, message injection testing.

## 2. Frontend / Web Tools

The rest: https://github.com/HoangNguyen0403/agent-skills-standard/blob/HEAD/.agents/skills/common/common-dast-tooling/SKILL.md