DAST scan

Test a running application the way an attacker would, and get back what actually responded.

Dynamic testing sends requests to a running web application and reports what it responded to. It covers these vulnerability families:

Set an app id and app key first. Results are saved against that app and shown in the console.

Run a scan

Point it at any URL you are authorised to test. Results land in your workspace as a standalone scan.

$ sentrasec dast https://your-app.example.com/

To track a target over time, register it once as an app and scan it by id. Results are grouped under the app with its history and posture.

$ sentrasec app scan <APP-ID>

Only test targets you own or have written permission to scan. Dynamic testing sends real attack payloads at the target.

Detection rules load for every family, both active and passive.
The target is probed with per-rule matchers. Each candidate is checked before it becomes a finding.
Findings are deduplicated. Many probes hitting the same weakness on the same endpoint collapse into one issue.
Each issue is enriched with business impact, technical detail, and CWE and OWASP mapping.
Results are saved to your workspace and shown in the console.

Machine-readable output for pipelines and downstream tooling:

$ sentrasec dast https://your-app.example.com/ --format json

Fail the build when something serious is found:

$ sentrasec dast https://staging.example.com/ --fail-on high

To test behind a login, record the session and pass it to the scan so authenticated surfaces are reachable.

$ sentrasec dast https://app.example.com/ --har ./auth.har