Dynamic security testing in SourceCraft

Dynamic Application Security Testing (DAST) allows detecting vulnerabilities in a running application. A scanner accesses an application at the specified URL, goes through the available pages and endpoints, sends test requests, and analyzes responses.

In SourceCraft, dynamic testing is implemented using the integration with Yandex Security Deck and SolidPoint DAST. It uses the application and service endpoints scanning feature of the Vulnerability Management (VM) module in Security Deck. You can use the SourceCraft UI to set up and run testing as well as view warnings.

Running dynamic testing

1. Open the SourceCraft home page.

2. On the Home tab, navigate to Repositories and select a repository.

3. Under  Security on the repository page, go to  Dynamic testing.

4. In the top-right corner, click Run dynamic testing.

5. In the window that opens, in the Target URL field, enter the base URL of your running application.

   The URL requirements are as follows:

   • It must provide access over HTTPS on standard port 443.
   • It must be from the Yandex Cloud public IP address range.
   • It must not include user credentials.

   Note

   If the URL does not meet the requirements, you will get an error message. Check the protocol, port, and IP addresses the application's domain name resolves to, then edit the URL.

6. Confirm that you understand the nature of check.

   Warning

   DAST runs on an active application by creating additional workload and sending requests that may trigger actions in the application and related systems. Keep this in mind when choosing an application and testing time.

7. Click Run now.

Viewing results

Under  Security on the repository page, go to  Dynamic testing.

Use the search bar and filters to find the warnings you need. The default filter is by the Open and Confirmed statuses. If the list is empty, check or reset the filters. To change the order of warnings, use sorting by significance.

You can find examples of detected vulnerabilities in the Dynamic testing section of the demo repository.

Here is an example of a list of warnings from the demo report:

The localhost addresses on the screenshot are demo data. To run scanning via Security Deck, use an application address that meets the requirements.

Use cases

• Testing a deployed application for vulnerabilities before releasing a new version.
• Retesting an application after fixing the detected issues.

Useful links

• Dynamic testing in the appsec-analysis demo repository
• Security in SourceCraft
• Static application security testing in SourceCraft
• Scanning application and service endpoints in Security Deck
• SourceCraft pricing policy