Dynamic Application Security Testing (DAST) Tools

Escape is doing amazing things with their approach to DAST. They thoroughly discover your APIs and schemas by searching your frontend code, and then test those APIs from the outside. They have great scanning support for modern languages, and also in depth testing configurations.

StackHawk is a developer-first DAST, and it shows every step of the way. They're built to scan quickly, in pipeline, and make it easy to attempt to reproduce issues. They're a major player in reshaping modern DAST and have really paved a way for the future with features like fuzzing API specific data.

Acquired by Checkmarx, ZAP (Zed Attack Proxy) is the scanning tool underlying numerous scanners, and if your internal team is up for the challenge, it can be adapted directly to provide most scanning needs.

Bright runs a DAST scanner that's focused on API testing via the CLI kicking off cloud based scans in pipeline. They support ingesting the API docs via the pipeline, and are building some interesting features around local fuzzing as a new type of SAST.

Pynt has created an elegant solution for running DAST type scanning against your APIs by running tests via a local proxy. This helps to bypass a lot of the pain with configuring DAST tools against your endpoints. They also do API discovery, drift detection, and testing via network integrations.

Nighvision creates API docs based on scanning your code, and then tests those endpoints from the outside based on the docs they created.