AppSecNews

Top 10
Articles
About
Contact

Browse by category

SAST31 Static Application Security Testing
SCA28 Software Composition Analysis
DAST34 Dynamic Application Security Testing
IAST6 Interactive Application Security Testing
RASP9 Runtime Application Self-Protection
AI Security45 AI and LLM Security
API Security9 API Security
IaC Security17 Infrastructure as Code Security
ASPM16 Application Security Posture Management
Mobile Security23 Mobile Application Security
Container Security8 Container and Image Security
Secret Scanning9 Secret Detection and Scanning
WAF1 Web Application Firewall

Start here

All categories
Top 10 lists by category
Buyer guides and comparisons

Counts are published profiles. Every listing follows the same editorial standard; none are paid for.

Top 10
Articles
About
Contact

Dynamic Application Security Testing

Probe a running application from the outside, the way an attacker would.

34 tools profiled

How it differs Tests the running application from the outside, with no access to source. SAST never runs the app; IAST instruments it from the inside.

Filters

License

Open source 1 Open source and commercial 0 Commercial 0 Commercial, free tier 0 Freemium 0 Free 0

Subcategory

Web App Testing 1 Api Security 0 Authenticated scanning 0 Api Scanning 0 Ci Cd Scanning 0 Vulnerability Management 0 Manual Testing 0 Automated Pentesting 0 Intercepting Proxy 0 Reconnaissance 0 Vulnerability Scanning 0 Ai Agent Testing 0 Cli Scanning 0 Enterprise Dast 0 Extensibility 0 Graphql Testing 0 Misconfiguration Detection 0 Api Discovery 0 Api Fuzzing 0 Asset Discovery 0 Attack Surface Management 0 Attack Surface Monitoring 0 Binary Analysis 0 Black Box Scanning 0 Business Logic Testing 0 Command Line Scanner 0 Compliance Reporting 0 Continuous Pentesting 0 Crowdsourced Research 0 Cve Detection 0 Developer First Dast 0 Developer Tooling 0 Exploitation 1 External Scanning 0 Fuzzing 0 Hosted Scanning 0 Iast Agent 0 Infrastructure Scanning 0 Lightweight Scanner 0 Managed Service 0 Network Scanning 0 Pentest As A Service 0 Platform Integrated Dast 0 Plugin Framework 1 Proof Based Scanning 0 Reporting 0 Review App Scanning 0 Scan Orchestration 0 Subdomain Discovery 0 Symbolic Execution 0 Template Based Scanning 0 Waf 0 Web Server Scanning 0

Deployment

CI/CD 0 SaaS 0 Self hosted 0 CLI 1 Desktop 1 Kubernetes 0 Agent 0 Browser extension 0

Languages

C++ 0 Cpp 0 Go 0 Java 0 Python 0 Rust 0

Integrations

Jira 0 Jenkins 0 Azure DevOps 0 Slack 0 GitHub Actions 0 GitHub 0 Gitlab Ci 0 GitLab 0 ServiceNow 0 CircleCI 0 Splunk 0 Bitbucket 0 Bugzilla 0 Webhooks 0 Aws 0 Azure 0 Docker 0 Elasticsearch 0 Gitlab Issues 0 Gitlab Merge Requests 0 Google Cloud 0 Mantis 0 Maven 0 Metasploit 0 Micro Focus Alm 0 Microsoft Teams 0 Nmap 0 Opsgenie 0 PagerDuty 0 Selenium 0 Ssc 0 Teamcity 0 Tfs 0

Maturity

Established 1 Growing 0 Emerging 0

Signals Verified profile 0 Has endorsements 0

Clear

1 tool match

Sort

Active Exploitation Clear all

w3af

Andres Riancho and contributors

DAST

Open source web application attack and audit framework built around crawl, audit, grep and attack plugins driven from a console or GUI.

Open source

Established Compare w3af

w3af

Andres Riancho and contributors

Open source web application attack and audit framework built around crawl, audit, grep and attack plugins driven from a console or GUI.

Open source Established

DAST Compare w3af

Tick up to 4 tools above.

Pick at least one more

Other categories

← Software Composition Analysis Interactive Application Security Testing →

SAST
SCA
IAST
RASP
AI Security
API Security
IaC Security
ASPM
Mobile Security
Container Security
Secret Scanning
WAF

Newsletter

AppSecNews Weekly

New tool profiles, head to head comparisons and guides, in one short email. No tracking pixels, and every issue has a one click unsubscribe. Read past issues

Leave this field empty

Email address

Email me the newsletter. One click in any issue unsubscribes, and the address is never shared or sold. We send a confirmation link first.

AppSecNews

Independent research on application security tooling, written for the people who have to choose it.

editorial policy

Every profile follows one published standard: no pricing, no version claims, no invented ratings, and a limitations section for every tool. Listings are never paid for. Advertising is labelled and never affects placement. Read the policy

1 tool match

w3af

w3af