xygeni/xy-dast repository overview

⁠Xygeni DAST Scanner

Dynamic Application Security Testing (DAST) scanner for web applications and REST APIs. Detects vulnerabilities like SQL injection, XSS, SSRF, misconfigurations, and known CVEs by actively probing running targets.

⁠Quick Start

docker run --rm xygeni/xy-dast:latest scan -u https://your-app.example.com

⁠Supported Platforms

Published as a multi-arch manifest list — Docker selects the matching variant automatically:

• linux/amd64 — Intel/AMD x86_64 hosts
• linux/arm64 — Apple Silicon (M1/M2/M3/M4) and other arm64 hosts; runs natively, no Rosetta/QEMU emulation

⁠Features

• Web & API scanning — traditional web apps, SPAs, REST APIs (via OpenAPI), GraphQL, SOAP/WSDL endpoints, and CMS platforms (WordPress/Drupal/Joomla)
• Two-axis scan profiles — pick a tech base (traditional, spa, openapi, graphql, soap, cms) with --profile, and an intensity (quick, balanced, deep, passive) with --intensity; or auto-detect the tech base with --auto-profile (technology fingerprinting)
• Vulnerability detection — Active/passive rules, plus optional templates for CVE / misconfiguration / exposure detection (--vuln-check)
• Deep crawling — JavaScript-aware crawling for modern SPAs.
• Authentication — form login, Bearer / JWT, API key (header), HTTP Basic, OAuth2, mTLS, pre-authenticated SSO session import, and scripted multi-step browser login
• Reproducible evidence — every finding includes the request, response, payload, parameter, and CWE
• Compliance mappings — CWE, NIST 800-53, SANS Top 25, and PCI DSS classifications on each finding
• Quality gates — fail CI pipelines when findings exceed a severity threshold (--fail-on)
• Xygeni integration — findings in Xygeni DAST format, automatic upload to the Xygeni platform

⁠Usage

The simplest way to try it out — one self-contained docker run:

docker run --rm xygeni/xy-dast scan -u https://target.example.com

For anything beyond a smoke test, install the xy-dast wrapper described below; the rest of the examples use it.

⁠Install the xy-dast wrapper (recommended)

The image ships an installer that drops a small xy-dast wrapper plus a sidecar xy-dast-compose.yml on the host, so you can invoke xy-dast like a native command. The wrapper handles env forwarding (XYGENI_TOKEN, XYGENI_URL, XYGENI_DASHBOARD_URL), output volume mounting, and network_mode: host.

Linux / macOS:

docker run --rm -v ~/.local/bin:/mnt/install xygeni/xy-dast install

Windows (PowerShell):

docker run --rm -v C:\Tools:/mnt/install xygeni/xy-dast install --powershell

The wrapper is byte-stable and signed at release time (Authenticode for .ps1); the installer copies it byte-exact to preserve the signature. Requires docker compose v2 (bundled with Docker Engine 20.10+ / Docker Desktop).

To pin the wrapper to a specific image tag or digest, pass --image:

docker run --rm -v ~/.local/bin:/mnt/install xygeni/xy-dast \
  install --image xygeni/xy-dast:6.8.0

⁠Examples (with the wrapper)

# Show the full command syntax and every available flag
xy-dast --help
xy-dast scan --help

# Scan a web application
xy-dast scan -u https://target.example.com -o report.json

# Scan a REST API with OpenAPI spec
xy-dast scan -u https://api.example.com \
  --profile openapi --openapi https://api.example.com/swagger.json \
  -o report.json

# Deep scan of an SPA (deep intensity turns on deep crawl + CVE checking)
xy-dast scan -u https://app.example.com \
  --profile spa --intensity deep \
  -o report.json

# Production-safe passive scan (no active attack payloads)
xy-dast scan -u https://staging.example.com \
  --profile traditional --intensity passive \
  -o report.json

# Scan with authentication and a CI quality gate
export API_TOKEN=...
xy-dast scan -u https://target.example.com \
  --bearer-token env:API_TOKEN \
  --fail-on high \
  -o report.json

⁠Image Verification

This image is signed with Sigstore cosign⁠. Verify the signature before installing:

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'github\.com/xygeni/xy-dast' \
  xygeni/xy-dast:6.8.0

SBOM and SLSA provenance attestations are attached to every release.

⁠Environment Variables

⁠Exit Codes

⁠Links

• Xygeni DAST Documentation⁠
• Report an issue: [email protected]⁠