Test web applications and APIs with Polaris fAST Dynamic

Dynamic application security testing (DAST) is an AppSec testing methodology that examines web applications and APIs at runtime by simulating attacks to identify potential vulnerabilities. DAST is known as "black-box testing". DAST tools have no visibility of a web application's source code, internal interactions, or designs at the system level. They observe a web application from the outside in, examine its running state, and observe its responses to simulated attacks. The application's responses to these simulations help determine whether it's vulnerable and might be susceptible to a real malicious attack.

Polaris fAST Dynamic is a dynamic analysis engine and UI that brings self-service DAST capabilities to the Polaris platform.

Key features

• Advanced DAST scanner optimized for single-page applications (SPAs), JavaScript frameworks, and APIs.
• Fully automated DAST testing, tightly integrated with the Polaris UI and API, with fast project onboarding and scan initiation.
  • Includes AI-assisted annotation for BOLA issues within API specifications.

• Securely access internal web applications and APIs (inside private networks) with the secure tunnels feature, powered by the Teleport Access Platform.

• Authenticated DAST scans:
  • Support for several site and API authentication methods, including AI-assisted authentication, Simple, SAML, and multi-factor authentication (MFA) via email or TOTP.
  • Capture site login flows using Selenium or Chrome Recordings.
• Smart Settings: DAST scan settings are auto-configured in a pre-flight phase.
• Optimized checkers deliver low false positives while providing accurate vulnerability detection—emphasizing high-value checks that identify the highest-risk issues.
• Scales to accommodate a large number of DAST projects without compromising on performance.
• View DAST issues alongside SAST and SCA issues and triage by severity.
• Run DAST tests from pipelines using the Bridge CLI, including on internal applications.
• Developer Detail Dynamic report gives an overview of all DAST issues in the selected application scope.

fAST Dynamic includes functionality to perform active attacks on your pre-production web applications and APIs.

If you select the Perform Active Attacks checkbox when creating a DAST project, fAST Dynamic will simulate real-world attacks by sending various inputs and then observing the application's or API's behavior. For more details, see fAST Dynamic checkers.

In the Polaris data model, DAST projects represent web applications and APIs—both external and internal—that are targeted for dynamic application security testing (DAST). Each DAST project is associated with a DAST profile. The profile defines scan settings used to test the target for vulnerabilities and a separate authentication profile that handles authentication by the scanner. For certain API checkers, such as those for detecting BOLA issues, you must create more than one authentication profile.

DAST projects are separate from SAST & SCA projects.

You can create multiple DAST projects across your applications, up to the maximum quantity defined in your DAST entitlement (see Subscriptions and Entitlements in Polaris). For example, an application might contain one DAST project for a web application and one for a REST API.

You can view the number of DAST projects used and remaining in your entitlement on the Projects tab. For example: