DAST Tools logopeterindia.net
Knowledge Hub

Dynamic Application Security Testing (DAST) Tools

A directory of dynamic application security testing tools — scanners that test running web applications and APIs from the outside for OWASP Top 10 flaws — from enterprise platforms to open-source projects.

27 topics•4 categories•Updated October 2026

Enterprise DAST Platforms

9 entries

Web and API scanners for security teams, with scheduling, CI/CD integration and reporting.

01Invicti (including Netsparker and Acunetix)Web vulnerability scanner with proof-based scanning that confirms findings. Netsparker is now Invicti, and the Acunetix site now redirects to Invicti. 02Veracode Dynamic AnalysisAutomated web application scanning on Veracode's platform alongside static analysis and SCA. 03Rapid7 InsightAppSecDynamic application security testing for applications built on complex JavaScript frameworks. 04OpenText Fortify DAST (WebInspect)Dynamic application security testing from OpenText, formerly sold as Fortify WebInspect. 05HCL AppScanApplication security testing platform covering dynamic, static, interactive and open-source analysis. 06CheckmarxApplication security platform; Checkmarx also maintains ZAP. 07Burp Suite (PortSwigger)Web security testing toolkit, with an Enterprise edition for scheduled and CI/CD scans. 08Qualys Web Application ScanningWeb application scanning from the Qualys platform. 09AppCheckVulnerability scanning for websites, applications, networks and cloud infrastructure.

Developer-First & Cloud DAST

8 entries

Scanners aimed at developers, CI/CD pipelines and SaaS teams.

10DetectifyWeb vulnerability scanning with tests contributed by a community of ethical hackers. 11StackHawkDeveloper-focused DAST and API security testing for CI/CD. 12Bright SecurityDAST with automated fix suggestions for application security teams. 13Beagle SecurityAppSec platform for automated web application and API testing. 14EscapeOffensive security platform for web applications and APIs. 15IntruderVulnerability scanning and attack-surface monitoring. 16Pentest-Tools.comOnline toolkit for vulnerability scanning and penetration testing. 17AppknoxMobile application security testing, including dynamic analysis.

Open-Source Scanners

4 entries

Free scanners, widely used in pipelines and manual testing.

18OWASP ZAP (ZAP by Checkmarx)Free, open-source web application security scanner with add-ons and CI/CD automation. 19NucleiFast, template-based vulnerability scanner. GitHub lists v3.11.1 as the latest release, from July 2026. 20WapitiFree, open-source web application vulnerability scanner. 21NiktoOpen-source web server scanner.

Related Pages

6 entries

Related directories on this site.

22Application Security Testing ToolsAST platforms covering SAST, DAST, IAST and SCA. 23SAST ToolsStatic application security testing tools. 24Penetration Testing ToolsPenetration testing tools. 25Software TestingHub of software testing directories. 26Software EngineeringHub of software engineering directories. 27CybersecurityCybersecurity solutions and services.

Frequently Asked Questions

What is DAST?

Dynamic application security testing probes a running application from the outside, simulating attacks to find issues such as SQL injection, cross-site scripting and misconfiguration, without access to the source code.

How does DAST differ from SAST and IAST?

SAST analyses source code before it runs, DAST attacks the running application from outside, and IAST instruments the application from inside while it is tested. The three find different problems.

Which products were renamed or merged?

Netsparker is now Invicti, Acunetix now redirects to Invicti, and Fortify WebInspect is now OpenText Fortify DAST.

Why was Mister Scanner removed?

Its former website now serves unrelated content, so it is no longer listed.

Why are the old ranking claims gone?

The earlier page carried badges such as "Gartner Leader" and "100% verified" without sources, so they were removed. Cards now describe each product only.