Find the right tools to identify vulnerabilities in your running applications by simulating threats easily accessed by external hackers.
SHARE
back to BLOG

Top Dynamic Application Security Testing (DAST) tools [2024]

James Harrison

What is Dynamic Application Security Testing?

Dynamic Application Security Testing (DAST) tools are a method of testing the security of your web applications where a running app is actively tested and probed using real traffic and requests. This evaluates the application from the “outside in”, by attacking the application like an attacker would, to find any security vulnerabilities.

As your application changes, grows and evolves, DAST scanning tools can continue to scan them so that your DevOps team can quickly fix any new or emerging issues before they can grow into more serious risks.

What’s the difference between DAST and SAST?

While DAST solutions test the app from the outside, SAST (Static Application Security Testing) looks at the application from the “inside out” by searching for vulnerabilities in the source code.

DAST security testing tools test the application in runtime to see if it’s vulnerable to common security vulnerabilities. As a form of closed box testing, DAST assumes the tester doesn’t know the application’s inner functions, such as those that appear only when the program is running.

As DAST requires a complete working application to do this, it’s often used at later or the end phase of the development cycle. Testers need to interact with the application such as providing inputs, checking outputs, and simulating other actions typical of user interactions. These make sure the application is not susceptible to attacks such as cross-site scripting or SQL injection.

When should you use DAST or SAST?

Because SAST tests your application’s internal source code early on, it helps developers to follow best practice and write secure code. SAST is technology-dependent, so any tool should support your programming language and dev framework to make sure everything is covered. As such, it can make remediation quick and easy.  

On the other hand, DAST is technology-independent, because it tests the application when running from an external user perspective and doesn’t just check your code. DAST security tools also look at the environment that the web application runs in. For example, it will help pinpoint a vulnerability in the application itself and in the web server configuration. It can even tell you if you’re using a weak password. No other tool can do all that at the same time.

If possible, you should integrate both SAST and DAST in your CI/CD pipeline as part of a comprehensive DevSecOps approach. This will help your team integrate security without reducing the speed of deployment. But that’s not always possible, practical or affordable, so in this article, we’ll focus on the best DAST scanning tools for 2024.

4 best DAST tools for security teams in 2024

Intruder

Intruder is an automated attack surface management tool that includes continuous scanning for known weaknesses in a wide range of products, web apps and their underlying infrastructure. Its dynamic application security testing (DAST) scanner checks for common application layer vulnerabilities as well as known weaknesses in web application software, and provides comprehensive reports to show the security of your apps to customers and auditors.

Key benefits

Acunetix

Acunetix from Invicti is dedicated web application scanner that blends DAST and interactive application security testing (IAST) to detect over 7,000 vulnerabilities. This includes scanning in hard-to-scan places like password-protected areas and multi-level forms.

Top Dast Tools - Acunetix - Intruder
Acunetix dashboard

Key benefits

Rapid7 InsightAppSec

InsightAppSec is a vulnerability management tool that’s aimed at enterprises with large IT networks and security teams. Performs black-box security testing of web applications to automate identification, triage vulnerabilities, prioritize actions, and remediate application risk, providing reports to established security teams.

Top Dast Tools - Rapid7- Intruder
InsightAppSec dashboard

Key benefits

Qualys WAS

The Qualys WAS cloud-based application scanner discovers, detects, and catalogs web applications and APIs to uncover runtime vulnerabilities, misconfigurations, PII exposures, and web malware. Designed primarily for larger enterprises with hundreds of apps, it provides visibility and control by finding official, ‘unofficial’, and forgotten applications.

Top Dast Tools - Qualys WAS - Intruder
Qualys WAS dashboard

Key benefits

3 best DAST testing tools for penetration testers in 2024

Burp Suite Professional

Burp Suite's Porfessional edition has long been one of the industry’s most trusted toolkits because of its comprehensive features and reliability. Its intercepting proxy feature allows users to intercept and modify HTTP requests and responses so you get a thorough analysis of the communication between web browsers and the target application to help you discover potential security vulnerabilities.

Top Dast Tools - Burp Suite Professional - Intruder
Burp Suite Professional dashboards

Key benefits

Nuclei

Open-source scanner Nuclei uses a vast library of community-powered templates to scan web applications. Seamlessly integrates into CI/CD pipelines for automated security testing as part of the development process to ensure continuous security and regression of custom vulnerabilities, and is actively maintained by the ProjectDiscovery team to provide an up-to-date scanning framework.

Top Dast Tools - Nuclei - Intruder
Nuclei fuzzing options

Key benefits

ZAP

Zed Attack Proxy (ZAP) is a free, open-source penetration testing tool being maintained under the umbrella of The Software Security Project (SSP). ZAP is designed specifically for testing web applications and is both flexible and extensible.

Top Dast Tools - ZAP - Intruder
ZAP portal

Key benefits

How Intruder can do the hard work for you

With web app attacks on the rise, it’s important to prioritize web application security early in the development cycle. DAST tools give you timely insights into the behavior of web applications once they’re in production and running, but penetration testing is another tried and tested form of web application security testing that you should consider using in combination with DAST – especially if you’re using DAST tools for DevSecOps. Penetration testing provides a real-world demo of how an attacker might break into your web application.  

Intruder provides dedicated penetration testing services in addition to its automated web application security scanner, which is a robust and effective DAST security testing tool that proactively scans your systems for emerging threats, notifying you as soon as new vulnerabilities are discovered. Intruder's Rapid Response can also manually check for the latest issues that are being exploited in the wild before automated scanners check for them. Why not try us for free for 14 days?

Release Date
Level of Ideal
Comments
Before CVE details are published
🥳
Limited public information is available about the vulnerability.

Red teamers, security researchers, detection engineers, threat actors have to actively research type of vulnerability, location in vulnerable software and build an associated exploit.

Tenable release checks for 47.43% of the CVEs they cover in this window, and Greenbone release 32.96%.
Day of CVE publish
😊
Vulnerability information is publicly accessible.

Red teamers, security researchers, detection engineers and threat actors now have access to some of the information they were previously having to hunt themselves, speeding up potential exploit creation.

Tenable release checks for 17.12% of the CVEs they cover in this window, and Greenbone release 17.69%.
First week since CVE publish
😐
Vulnerability information has been publicly available for up to 1 week.

The likelihood that exploitation in the wild is going to be happening is steadily increasing.

Tenable release checks for 10.9% of the CVEs they cover in this window, and Greenbone release 20.69%.
Between 1 week and 1 month since CVE publish
🥺
Vulnerability information has been publicly available for up to 1 month, and some very clever people have had time to craft an exploit.

We’re starting to lose some of the benefit of rapid, automated vulnerability detection.

Tenable release checks for 9.58% of the CVEs they cover in this window, and Greenbone release 12.43%.
After 1 month since CVE publish
😨
Information has been publicly available for more than 31 days.

Any detection released a month after the details are publicly available is decreasing in value for me.

Tenable release checks for 14.97% of the CVEs they cover over a month after the CVE details have been published, and Greenbone release 16.23%.

With this information in mind, I wanted to check what is the delay for both Tenable and Greenbone to release a detection for their scanners. The following section will focus on vulnerabilities which:

These are the ones where an attacker can point their exploit code at your vulnerable system and gain unauthorised access.

We’ve seen previously that Tenable have remote checks for 643 critical vulnerabilities, and OpenVAS have remote checks for 450 critical vulnerabilities. Tenable release remote checks for critical vulnerabilities within 1 month of the details being made public 58.4% of the time, but Greenbone release their checks within 1 month 76.8% of the time. So, even though OpenVAS has fewer checks for those critical vulnerabilities, you are more likely to get them within 1 month of the details being made public. Let’s break that down further.

In Figure 10 we can see the absolute number of remote checks released on a given day after a CVE for a critical vulnerability has been published. What you can immediately see is that both Tenable and OpenVAS release the majority of their checks on or before the CVE details are made public; Tenable have released checks for 247 CVEs, and OpenVAS have released checks for 144 CVEs. Then since 2010 Tenable have remote released checks for 147 critical CVEs and OpenVAS 79 critical CVEs on the same day as the vulnerability details were published. The number of vulnerabilities then drops off across the first week and drops further after 1 week, as we would hope for in an efficient time-to-release scenario.

Figure 10: Absolute numbers of critical CVEs with a remote check release date from the date a CVE is published

While raw numbers are good, Tenable have a larger number of checks available so it could be unfair to go on raw numbers alone. It’s potentially more important to understand the likelihood that OpenVAS or Tenable will release a check of a vulnerability on any given day after a CVE for a critical vulnerability is released. In Figure 11 we can see that Tenable release 61% their checks on or before the date that a CVE is published, and OpenVAS release a shade under 50% of their checks on or before the day that a CVE is published.

Figure 11: Percentage chance of delay for critical vulnerabilities

So, since 2010 Tenable has more frequently released their checks before or on the same day as the CVE details have been published for critical vulnerabilities. While Tenable is leading at this point, Greenbone’s community feed still gets a considerable percentage of their checks out on or before day 0.

I thought I’d go another step further and try and see if I could identify any trend in each organisations release delay, are they getting better year-on-year or are their releases getting later? In Figure 12 I’ve taken the mean delay for critical vulnerabilities per year and plotted them. The mean as a metric is particularly influenced by outliers in a data set, so I expected some wackiness and limited the mean to only checks released 180 days prior to a CVE being published and 31 days after a CVE being published. These seem to me like reasonable limits, as anything greater than 6 months prior to CVE details being released is potentially a quirk of the check details and anything after a 1-month delay is less important for us.

What can we take away from Figure 12?

Figure 12: Release delay year-on-year (lower is better)

With the larger number of checks, and still being able to release a greater percentage of their remote checks for critical vulnerabilities Tenable could win this category. However, the delay time from 2019 and 2020 going to OpenVAS, and the trend lines being so close, I am going to declare this one a tie. It’s a tie.

The takeaway from this is that both vendors are getting their checks out the majority of the time either before the CVE details are published or on the day the details are published. This is overwhelmingly positive for both scanning solutions. Over time both also appear to be releasing remote checks for critical vulnerabilities more quickly.

Written by

James Harrison

Recommended articles

Ready to get started with your 14-day trial?
try for free