DAST Scan Modes
How different DAST scan modes affect testing behavior, speed, and operational risk, and how to choose the appropriate mode for different testing scenarios.
Primary question: How should teams choose between standard and more aggressive DAST scan modes?
Direct answer
DAST scan modes range from standard to aggressive to active attack, with increasing operational risk. Teams should choose modes based on the testing environment, application criticality, and operational tolerance for aggressive testing
DAST scan modes range from standard to aggressive to active attack, with increasing operational risk. Standard mode performs vulnerability detection without attacking the application. Aggressive mode performs scanning plus executing attacks. Active attack mode attacks the application from the beginning of the scan.
Scan mode selection should consider the testing environment, application criticality, and operational tolerance. Standard mode is appropriate for development and staging environments where operational risk is acceptable. More aggressive modes should be used with caution and only in environments where the increased load and testing intensity will not cause disruption.
No scan mode guarantees complete security testing. Coverage depends on what code paths, endpoints, and attack scenarios are exercised during the scan, regardless of the scan mode selected. DAST should be combined with SAST for broader coverage than either technique alone.
Definitions
Standard scan mode
A DAST scan mode that performs vulnerability detection without attacking the application.
Aggressive scan mode
A DAST scan mode that performs scanning plus executing attacks at the cost of increased load on the running application and higher operational risk.
Active attack mode
A DAST scan mode where the application is attacked from the beginning of the scan.
Operational risk
The risk that dynamic testing may disrupt the running application, cause data corruption, or trigger production alerts due to the nature of security testing inputs.
The engineering problem
Using an overly aggressive scan mode in a production or critical environment may cause disruption, data corruption, or false alerts, while using only standard mode may exercise fewer attack scenarios.
Teams may not understand the trade-offs between scan modes, leading to either insufficient coverage or unnecessary operational risk.
No single scan mode provides complete coverage. Different modes exercise different code paths and attack scenarios, and combining modes may provide more comprehensive testing.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Standard scan
Standard DAST mode- Artifact
- Running application in a test or staging environment.
- Risk
- Fewer attack scenarios exercised.
- Output
- DAST findings from standard vulnerability detection with moderate operational risk.
Evidence:
Aggressive scan
Aggressive DAST mode- Artifact
- Running application in a controlled environment.
- Risk
- Increased load on the application and higher operational risk.
- Output
- DAST findings from scanning plus executing attacks with increased operational risk.
Evidence:
Active attack scan
Active attack DAST mode- Artifact
- Running application in a controlled environment with appropriate safeguards.
- Risk
- Highest operational risk including potential data disruption or production alerts.
- Output
- DAST findings from active exploitation attempts with heightened operational risk.
Evidence:
Verification workflow
- Assess the testing environment, application criticality, and operational tolerance.
- Select an appropriate scan mode based on the assessment — standard for most scenarios, aggressive or active attack in controlled environments.
- Configure the DAST scan with appropriate authentication and endpoint coverage.
- Run the scan and monitor the running application for operational impact.
- Review DAST findings and assess coverage.
- If more attack scenarios need to be exercised, consider running additional scans in more aggressive modes.
- Correlate DAST findings with SAST findings if available.
- Remediate findings and verify through rescan.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner DAST provides configurable scan modes including standard, aggressive, and active attack to change testing behavior and operational risk.
DerScanner DAST supports configurable scan modes including standard, aggressive, and active attack. [derscanner-dast-settings]
Limits of verification
- No scan mode guarantees complete coverage. Coverage depends on what code paths, endpoints, and attack scenarios are exercised during the scan.
- Aggressive and active attack modes carry operational risk and should only be used in controlled environments where disruption is acceptable.
- Correlation with SAST findings requires a supported mechanism; not all SAST and DAST tools provide correlation functionality.
Related knowledge
Combining SAST and DAST
Why organizations use both SAST and DAST together
Relationship: related-toAuthenticated DAST Testing
Why authentication is important in dynamic analysis
Relationship: related-toContinuous DAST Rescanning
Why dynamic testing should be repeated as applications change
Relationship: related-toCanonical terms used: DAST scan modes; Standard vs aggressive scanning; Active attack mode; Operational risk.
Evidence and references
- DerScanner dynamic analysis documentationDerScanner DAST is a web-application scanner that detects vulnerabilities and backdoors by providing malformed or random inputs, using the black-box method without requiring source code. When source code is available, dynamic-analysis results can be correlated with static-analysis results for better accuracy and easier prioritization.
derscanner-dast - DerScanner DAST settings documentationDerScanner DAST settings include authorization methods and credentials for authenticated scanning, standard/aggressive/active-attack scan modes, AJAX spider configuration, OpenAPI definition URL, targeted results based on OpenAPI, and scheduled automatic scanning.
derscanner-dast-settings
DAST scan modes