API Penetration Testing (DAST)

The AppSentinels Platform provides Dynamic Application Security Testing (DAST) to perform advanced, automated vulnerability assessments of your APIs.

Overview

• AppSentinels DAST is a stateful, intelligent testing engine that automatically generates test cases based on API structures and data relationships observed during traffic analysis.
• Vulnerabilities identified during DAST are categorized under Active Scan.

DAST Configuration

Initial setup is required before running DAST tests:

• Define base test URL
• Configure login workflow for authenticated APIs
• Provide test user credentials

Configuration path: DAST → Configuration
Run or schedule tests from: DAST → Test

Viewing DAST Findings

• Navigate to Vulnerabilities in the AppSentinels dashboard.
• Filter the category by Active Scan.
• Each vulnerability entry includes:
  • Detailed issue description
  • Downloadable reproducible steps:
    • cURL commands
    • Postman collections

DAST Reports

DAST provides detailed reports containing:

• API Coverage: APIs covered during testing
• Test Coverage: Test cases executed per API
• Test Status: Pass/fail results for each test
• Vulnerability Summary: Overview of detected issues

DAST Integration and Scheduling

• Integrate DAST with CI/CD pipelines to trigger tests during builds and deployments.
• Alternatively, schedule recurring DAST jobs to validate security as new APIs are discovered.