xygeni/xy-dast repository overview

⁠Xygeni DAST Scanner

Dynamic Application Security Testing (DAST) scanner for web applications and REST APIs. Detects vulnerabilities like SQL injection, XSS, SSRF, misconfigurations, and known CVEs by actively probing running targets.

⁠Quick Start

docker run --rm xygeni/xy-dast:latest scan -u https://your-app.example.com

⁠Supported Platforms

Published as a multi-arch manifest list — Docker selects the matching variant automatically:

• linux/amd64 — Intel/AMD x86_64 hosts
• linux/arm64 — Apple Silicon (M1/M2/M3/M4) and other arm64 hosts; runs natively, no Rosetta/QEMU emulation

⁠Features

• Guided setup — xy-dast interactive interviews you about the target and writes the scan profile and/or command line; it asks for the name of an environment variable rather than for any credential
• Web & API scanning — traditional web apps, SPAs, REST APIs (via OpenAPI), GraphQL, SOAP/WSDL endpoints, and CMS platforms (WordPress/Drupal/Joomla)
• Two-axis scan profiles — pick a tech base (traditional, spa, openapi, graphql, soap, cms) with --profile, and an intensity (quick, balanced, deep, passive) with --intensity; or auto-detect the tech base with --auto-profile (technology fingerprinting)
• Vulnerability detection — Active/passive rules, plus optional templates for CVE / misconfiguration / exposure detection (--vuln-check)
• Deep crawling — JavaScript-aware crawling for modern SPAs.
• Incremental scans — re-test only the endpoints changed since a baseline (--incremental), driven by Xygeni API Security; merges with the previous report into a full snapshot — a large wall-time saving on pull-request pipelines
• Recorded-traffic seeding — seed the scan from a recorded browser navigation (Selenium IDE .side or Chrome DevTools Recorder JSON, replayed) or a HAR (imported) via --navigation
• Authentication — form login, JSON login with the token read from the response body (single-page apps), Bearer / JWT, API key (header), HTTP Basic, OAuth2, mTLS, pre-authenticated SSO session import (incl. Playwright storageState.json), and scripted multi-step browser login
• Reproducible evidence — every finding includes the request, response, payload, parameter, and CWE
• Compliance mappings — CWE, NIST 800-53, SANS Top 25, and PCI DSS classifications on each finding
• Quality gates — fail CI pipelines when findings exceed a severity threshold (--fail-on)
• Xygeni integration — findings in Xygeni DAST format, automatic upload to the Xygeni platform

⁠Usage

The simplest way to try it out — one self-contained docker run:

docker run --rm xygeni/xy-dast scan -u https://target.example.com

For anything beyond a smoke test, install the xy-dast wrapper described below; the rest of the examples use it.

⁠Install the xy-dast wrapper (recommended)

The one-line installer pulls this image, verifies its cosign signature and pins the wrapper to the digest it verified:

curl -fsSL https://get.xygeni.io/latest/dast/get-dast.sh | sh     # Linux / macOS
iwr -useb https://get.xygeni.io/latest/dast/get-dast.ps1 | iex    # Windows

xy-dast update keeps an install current, moving the wrapper and the image together.

The image also ships the installer directly, which drops a small xy-dast wrapper plus a sidecar xy-dast-compose.yml on the host, so you can invoke xy-dast like a native command. The wrapper handles env forwarding (XYGENI_TOKEN, XYGENI_URL, XYGENI_DASHBOARD_URL), output volume mounting, and network_mode: host.

Linux / macOS:

docker run --rm -v ~/.local/bin:/mnt/install xygeni/xy-dast install

Windows (PowerShell):

docker run --rm -v C:\Tools:/mnt/install xygeni/xy-dast install --powershell

The wrapper is byte-stable and signed at release time (Authenticode for .ps1); the installer copies it byte-exact to preserve the signature. Requires docker compose v2 (bundled with Docker Engine 20.10+ / Docker Desktop).

To pin the wrapper to a specific image tag or digest, pass --image:

docker run --rm -v ~/.local/bin:/mnt/install xygeni/xy-dast \
  install --image xygeni/xy-dast:6.16.0

⁠Examples (with the wrapper)

# Show the full command syntax and every available flag
xy-dast --help
xy-dast scan --help

# Scan a web application
xy-dast scan -u https://target.example.com -o report.json

# Scan a REST API with OpenAPI spec
xy-dast scan -u https://api.example.com \
  --profile openapi --openapi https://api.example.com/swagger.json \
  -o report.json

# Deep scan of an SPA (deep intensity turns on deep crawl + CVE checking)
xy-dast scan -u https://app.example.com \
  --profile spa --intensity deep \
  -o report.json

# Production-safe passive scan (no active attack payloads)
xy-dast scan -u https://staging.example.com \
  --profile traditional --intensity passive \
  -o report.json

# Scan with authentication and a CI quality gate
export API_TOKEN=...
xy-dast scan -u https://target.example.com \
  --bearer-token env:API_TOKEN \
  --fail-on high \
  -o report.json

# Incremental scan on a pull request (re-test only changed endpoints)
xy-dast scan -u https://target.example.com \
  --incremental \
  --changed-endpoints-file .xygeni.changed-endpoints.json \
  --baseline-report previous-report.json \
  -o report.json

⁠Image Verification

This image is signed with Sigstore cosign⁠. Verify the signature before installing:

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'github\.com/xygeni/xy-dast' \
  xygeni/xy-dast:6.16.0

SBOM and SLSA provenance attestations are attached to every release.

⁠Environment Variables

⁠Exit Codes

⁠Links

• Xygeni DAST Documentation⁠
• Report an issue: [email protected]⁠