DAST scan

Test a running application the way an attacker would, and get back what actually responded.

Dynamic testing exercises a running web application and reports findings that were genuinely reachable. It covers 13 vulnerability families:

Set an app id and app key first. Results are saved against that app and shown in the console.

Run a scan

Point it at any URL you are authorised to test. Results land in your workspace as a standalone scan.

$ sentrasec dast https://your-app.example.com/

To track a target over time, register it once as an app and scan it by id. Results are grouped under the app with its history and posture.

$ sentrasec app scan <APP-ID>

Only test targets you own or have written permission to scan. Dynamic testing sends real attack payloads at the target.

Detection rules load for all 13 families, both active and passive.
The target is exercised with proof-of-exploit matchers, so a finding means something actually responded.
Findings are deduplicated. Many probes hitting the same weakness on the same endpoint collapse into one issue.
Each issue is enriched with business impact, technical detail, remediation steps and CWE and OWASP mapping.
Results are saved to your workspace and shown in the console.

Machine-readable output for pipelines and downstream tooling:

$ sentrasec dast https://your-app.example.com/ --format json

Fail the build when something serious is found:

$ sentrasec dast https://staging.example.com/ --fail-on high

To test behind a login, record the session and pass it to the scan so authenticated surfaces are reachable.

$ sentrasec dast https://app.example.com/ --har ./auth.har