Dynamic scanning
Attack the running app the way an attacker would.
CodesGuard DAST crawls your live application or API, fuzzes every input it finds, and confirms each issue with the exact request that triggered it and the response that proves it landed. Scan behind the login by replaying a real session — MFA and SSO included.
GET /search?q=<svg/onload=confirm(1)> HTTP/1.1
Host: shop.acme.example
Cookie: session=eyJhbGciOi… (replayed session)
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
<h2>No results for <svg/onload=confirm(1)></h2>
The payload is returned unencoded in the page body — the element parses and executes. Differential oracle confirmed it on 3 of 3 attempts.
The question it answers
“Can it be exploited while it's running?”
Capabilities
What DAST does
Active scanning with the request and response that prove each issue.
Three scan depths
Baseline for a passive first pass, Quick active for real attack coverage without a long run, Full active with a browser-based crawl for JavaScript-heavy apps.
Authenticated scanning
Capture a real session through a streamed remote browser — any MFA, any SSO — and the scanner replays it to reach the pages and APIs where serious bugs live.
SPA and API aware
XHR capture and AJAX crawling seed the scanner with the endpoints a single-page app actually calls.
Engagement-scoped
Every scan runs against a DNS-verified target inside an attested engagement, with scope rules and exclusions you control.
Evidence, not guesses
The attack request, the response, a differential verdict and a remediation — attached to every finding.
Measured detection
Every change to the scanner is scored in CI against a planted-flaw application and a clean control. A regression in any class fails the build.
How it works
From input to evidence
Spider / crawl
The scanner discovers pages, forms, parameters and API endpoints — your attack surface.
Active attack
It fuzzes inputs with attack payloads to probe for exploitable weaknesses.
Authenticated coverage
With a captured session, it reaches protected pages and APIs behind the login.
Report
Confirmed issues become findings with severity and evidence in the unified Findings view.
Scan depths
Choose how hard it hits
Deeper scans find more and take longer. Every depth runs against a verified target inside an engagement.
Baseline
Passive spider plus baseline checks — no aggressive attacks.
Use when: A fast, low-risk first pass or a regular safety check.
Quick active
A fast active attack over the discovered surface.
Use when: Real attack coverage without a long run.
Full active
Comprehensive active testing with a browser-based crawl for modern, JavaScript-heavy apps.
Use when: A thorough assessment; the most complete coverage.
Available on
DAST is included on the plans below.
FAQ
DAST, in brief
Full walkthroughs live in the DAST documentation.
Why isn't there a URL box on the DAST page?
Targets live on an engagement so they can be verified once and reused safely across every run — with a recorded authorization and a defined scope.
How does authenticated scanning handle MFA?
You sign in yourself in a streamed remote browser, complete any MFA or SSO step, and CodesGuard captures the resulting session for the scanner to replay.
How do you keep results reproducible?
The scanning engine is pinned per workspace, so a scan run today and a scan run next month behave identically — and every finding carries the request and response that produced it.
Ship software you can prove is secure.
See the platform on your own code, or talk to us about a dedicated Enterprise stack.