DAST Web Application Scanner¶

The DAST Scanner (scanner-dast) is a VirtualSutra agent that performs dynamic application security testing (DAST) against web application targets. It is dispatched directly by the orchestrator, one task per WebApplicationConfig in the inspection scope, running in parallel with other scanner tasks.

Image: ghcr.io/virtual-sutra/scanner-dast Redis stream: vsutra:tasks:dast_scanner AgentType: DAST_SCANNER cascade_failure: False (a DAST failure does not block compliance or reporting)

Capabilities¶

• Active web application vulnerability scanning
• OWASP Top 10 coverage
• Findings tagged with source_agent = DAST_SCANNER
• Per-application WebApplicationConfig scope (SOC2-8)

Limitations¶

Out-of-band (OAST) detection is not available. Active scan rules that rely on OWASP ZAP's own callback service cannot receive a callback from the target: the scanner binds that service to loopback, and on Kubernetes the deny-ingress NetworkPolicy for scanner pods blocks inbound connections to the pod anyway. Those rules still run, but a vulnerability that is observable only out of band (for example blind SSRF, blind XXE, or blind command injection that calls back) is not reported. In-band detection is unaffected.

Configuration¶

Add one or more WebApplicationConfig entries to InspectionScope.web_applications:

scope:
  web_applications:
    - url: https://app.example.com
      alias: my-app

Finding Conventions¶