Skip to main content

Web Service (DAST)

Code and image scans catch flaws before deployment, but some vulnerabilities only surface in a real running environment. By sending actual requests to a running web service, this finds vulnerabilities that only surface dynamically (DAST). To prevent abuse, you can scan only domains you own/manage, and ownership is verified first at registration.

Supported targets

Independent of language or stack. Any web application reachable over HTTP / HTTPS is in scope, and template-based checks also probe network exposure surfaces (HTTP / DNS / TCP).

Why ownership verification is required​

Scanning an arbitrary URL risks attacking someone else's service or touching an internal network via SSRF. Vulinder does not allow free-form URL scanning and only targets verified domains. Ownership is re-verified live at scan time.

Ownership verification methods​

Prove domain ownership with one of the following. (Similar to the Google/Ahrefs methods)

  • HTML file upload : Place the issued vulinder_<token>.html file at the site root.
  • Meta tag : Add the issued meta tag to the page <head>.
  • DNS TXT : Add the issued TXT record to the domain DNS.

Register service: select web service

Registration steps​

  1. On the [Services] page, click Register service and select Web service (DAST).
  2. Enter the URL to test.
  3. Verify domain ownership with one of the methods above.
  4. Once verification is complete, run the DAST scan.

Vulnerabilities it finds​

  • CRITICAL Authentication/session management flaws, exposed admin/debug paths
  • HIGH Injection (reflected, etc.) and improper input handling
  • MEDIUM Misconfigured security headers, information disclosure

Results from multiple checks are merged and shown as a single scan result.

Caution in production

DAST generates real traffic against the target. For a production service, run it during low-traffic hours, and if needed, target a staging environment instead.

Handling results​

Findings are triaged in Vulnerability management just like other analyses.

Next steps​

Use the resultsVulnerability managementReview and handle findingsUse the resultsComplianceMapping against OWASP·CWEUse the resultsReportsExport PDF reportsOrganization · OperationsNotification channelsConfigure completion/finding alerts