DAST scan

Command sentrasec dastFamilies 13

Dynamic Application Security Testing fires live payloads at a running web app and reports exploitable findings. It covers 13 vulnerability families — SQLi, XSS, SSRF, XXE, command injection, NoSQLi, SSTI, path traversal, LDAP injection, file upload, auth bypass, header injection, and security misconfiguration.

You must authenticate first — results are saved to your workspace and shown in the dashboard.

1

Run a scan

Ad-hoc — scan a URL

Point it at any URL you're authorized to test. Results land in your workspace as a standalone (ad-hoc) scan.

$sentrasec dast https://your-app.example.com/
Scan under a project

Attach the scan to a project with --project-id so results are grouped with that project's history and posture.

$sentrasec dast https://your-app.example.com/ --project-id proj_abc123

Find the project ID in the dashboard under your project's settings. Omit it for a quick one-off scan.

You only test targets you own or have written permission to scan — DAST sends real attack payloads.

2

What happens

  • Rules load from the engine — the full active + passive corpus for all 13 families.
  • Payloads fire against the target with proof-of-exploit matchers (DB errors, timing, file reads, missing headers).
  • Findings are deduplicated — many payloads that hit the same weakness on the same endpoint collapse into one issue.
  • Each issue is enriched — business impact, technical detail, and step-by-step remediation, plus CWE + OWASP mapping.
  • Results are saved to your workspace and shown in the dashboard.
3

Options

JSON output
$sentrasec dast https://your-app.example.com/ --format json
Gate CI on severity
$sentrasec dast https://staging.example.com/ --fail-on high

--fail-on high exits non-zero if any finding is at or above the given severity — drop it into a pipeline step to block a deploy.

Authenticated scanning
$sentrasec dast https://app.example.com/ --har ./auth.har

Pass a recorded .har file to scan behind a login.

Flags

--format json|textOutput format (default text).
--fail-on <sev>Exit non-zero at or above critical|high|medium|low.
--har <path>HAR file for authenticated scanning.
--project-id <id>Attach results to a specific project.
--timeout <secs>Poll timeout waiting for the scan (default 120).