DAST
Dynamic Application Security Testing (DAST) is a security testing approach that evaluates running web applications by simulating real-world attacks. Unlike static code analysis, DAST analyzes applications during runtime to identify vulnerabilities that may be exploitable in a production environment.
Usage of DAST in Delivery Shield
Automatically trigger security scans against deployed applications.
Identify runtime vulnerabilities before applications reach production.
View scan results and vulnerability details within the OpsMx platform.
Enforce security policies based on vulnerability severity and compliance requirements.
Incorporate security testing into CI/CD workflows to support DevSecOps practices.
Generate reports that help development and security teams prioritize and remediate vulnerabilities.
To Manage DAST:
Navigate to Setup > Integrations.
In the Post Deploy panel, click DAST. The DAST integration page is displayed.
Click +New Account.
In the popup that appears, enter the values for the fields:
DAST Integration Type - Select the specific type of DAST scan you wish to perform (e.g., Dast Scan, API Scan, Postman Collection).
DAST Scan Integration Type:
If DAST scan integration type is selected, the following fields will be displayed:
Account Name (mandatory) - Enter a name for this OpsMx DAST integration account.
Service URL (mandatory)- Enter the base URL of the target application or service that needs to be scanned.
Scan Policy (mandatory)- Select the predefined security scan policies (e.g.; Default Policy, Dev CICD, Pen Test) to apply during the scan.
Retries -Specify the number of times the scanner should attempt to retry in case of a failure.
Threshold -Specify the acceptable threshold limit or score for the security scan results.
Delay -Set the delay duration (in seconds) between consecutive scan requests or retries.
Account -Specify the target application's associated account name, if applicable.
Application -Enter the specific name of the application that needs to be included for the security scan.
Service -Enter the name of the specific service or component within the application to be scanned.
Exclude Urls: Enter any specific URLs or endpoints that the scanner must avoid during its operation.
Pentest GPT Scan: Toggle this switch to enable or disable the AI-assisted Pentest GPT scanning capabilities.
Authentication Mode -Toggle this switch to enable authenticated scanning for applications that require a login.
User Name: Enter the valid username credential required to log into the target application.
Password: Enter the corresponding password credential required to log into the target application.
Login Url: Specify the exact URL of the authentication page where the scanner should perform the login.
Username Field: Enter the HTML field name, ID, or selector used for the username input on the application's login page.
Password Field: Enter the HTML field name, ID, or selector used for the password input on the application's login page.
Login Indicator: Enter a Regular Expression (Regex) pattern that appears on the screen to confirm a successful login (e.g.,
\Qadmin\E).Logout Indicator: Enter a Regular Expression (Regex) pattern that appears on the screen to confirm the user is logged out or unauthenticated (e.g.,
\QSign in\E).
Select the Teams and the corresponding Environments from the dropdown for which you want the integration to be available. The integration will be available for the selected teams and environment only.
You can select up to 5 teams for the integration to be displayed.
An example is given below for reference:
In the example above,
if Team 1, Team 2, and Team 3 are selected, only applications associated with these teams can access the integration. Any applications belonging to other teams, such as Team 4, will not have access to this account.
Even if the user who created this account is also an admin for Team 4, the integration account remains restricted and is not available for Team 4.
Access to the account is strictly limited to the specified Teams and Environments selected during account creation.
For Organization Admins:
When an Organization Admin creates an account without selecting specific Teams and Environments, the account will be universally applicable, granting access to all teams and all environments by default.
For Team Admins with Multiple Teams:
If a Team Admin who manages multiple teams creates an account without specifying particular Teams and Environments, the account will only be accessible to the teams for which the logged-in user holds admin privileges.
Click Save. The tool is connected.
API Scan Integration Type:
If API scan integration type is selected, the following fields will be displayed:
Account Name (mandatory)- Enter a name for this OpsMx DAST integration account.
OpenAPI spec URL (mandatory)- Enter tthe direct URL to the OpenAPI or Swagger specification file that defines the structure of the API to be scanned.
Authentication Type: Select the method used to authenticate against the API (e.g., apiKey, http).
For apiKey:
Apikey Name - Specify the exact key name or header used to pass the API token (e.g., 'Authorization' or 'x-api-key').
Apikey - Provide the actual API key, secret, or token string used for authentication.
Apikey In - Select where the API key should be injected during the HTTP request (e.g., header, Query or cookie).
For http:
Scheme - Select the scheme to be either basic authentication or bearer token authentication.
If selecting basic authentication, provide username and password to authenticate.
If selecting bearer authentication, provide the token to authenticate.
Service Url (mandatory)- Enter the base URL of the target application or API service that needs to be scanned.
Scan Policy (mandatory)- Select the predefined security scan policies (e.g.; Default Policy, Dev CICD, Pen Test) to apply during the scan.
Retries -Specify the number of times the scanner should attempt to retry in case of a failure.
Threshold -Specify the acceptable threshold limit or score for the security scan results.
Delay -Set the delay duration (in seconds) between consecutive scan requests or retries.
Application -Enter the specific name of the application that needs to be included for the security scan.
Service -Enter the name of the specific service or component within the application to be scanned.
Exclude Urls: Enter any specific URLs or endpoints that the scanner must avoid during its operation.
Pentest GPT Scan: Toggle this switch to enable or disable the AI-assisted Pentest GPT scanning capabilities.
Select the Teams and the corresponding Environments from the dropdown for which you want the integration to be available. The integration will be available for the selected teams and environment only.
You can select up to 5 teams for the integration to be displayed.
An example is given below for reference:
In the example above,
if Team 1, Team 2, and Team 3 are selected, only applications associated with these teams can access the integration. Any applications belonging to other teams, such as Team 4, will not have access to this account.
Even if the user who created this account is also an admin for Team 4, the integration account remains restricted and is not available for Team 4.
Access to the account is strictly limited to the specified Teams and Environments selected during account creation.
For Organization Admins:
When an Organization Admin creates an account without selecting specific Teams and Environments, the account will be universally applicable, granting access to all teams and all environments by default.
For Team Admins with Multiple Teams:
If a Team Admin who manages multiple teams creates an account without specifying particular Teams and Environments, the account will only be accessible to the teams for which the logged-in user holds admin privileges.
Click Save. The tool is connected.
Postman Collection Integration Type:
If Postman Collection integration type is selected, the following fields will be displayed:
Account Name (mandatory)- Enter a name for this OpsMx DAST integration account.
Postman Collection File (mandatory)- Upload the JSON file containing the exported Postman Collection to be used for the security scan.
Postman Collection Variables - Enter any key-value pairs representing variables needed to successfully execute the requests within your Postman Collection (e.g., environment variables, dynamic tokens).
Service Url (mandatory)- Enter the base URL of the target application or API service that needs to be scanned.
Scan Policy (mandatory)- Select the predefined security scan policies (e.g.; Default Policy, Dev CICD, Pen Test) to apply during the scan.
Retries -Specify the number of times the scanner should attempt to retry in case of a failure.
Threshold -Specify the acceptable threshold limit or score for the security scan results.
Delay -Set the delay duration (in seconds) between consecutive scan requests or retries.
Application -Enter the specific name of the application that needs to be included for the security scan.
Service -Enter the name of the specific service or component within the application to be scanned.
Exclude Urls: Enter any specific URLs or endpoints that the scanner must avoid during its operation.
Pentest GPT Scan: Toggle this switch to enable or disable the AI-assisted Pentest GPT scanning capabilities.
Select the Teams and the corresponding Environments from the dropdown for which you want the integration to be available. The integration will be available for the selected teams and environment only.
You can select up to 5 teams for the integration to be displayed.
An example is given below for reference:
In the example above,
if Team 1, Team 2, and Team 3 are selected, only applications associated with these teams can access the integration. Any applications belonging to other teams, such as Team 4, will not have access to this account.
Even if the user who created this account is also an admin for Team 4, the integration account remains restricted and is not available for Team 4.
Access to the account is strictly limited to the specified Teams and Environments selected during account creation.
For Organization Admins:
When an Organization Admin creates an account without selecting specific Teams and Environments, the account will be universally applicable, granting access to all teams and all environments by default.
For Team Admins with Multiple Teams:
If a Team Admin who manages multiple teams creates an account without specifying particular Teams and Environments, the account will only be accessible to the teams for which the logged-in user holds admin privileges.
Click Save. The tool is connected.
Last updated