Blogs›GitLab›Browser-based DAST Analyzer
GitLab's Dynamic Application Security Testing (DAST) has evolved to a new browser-based analyzer (DAST 2). This new analyzer integrates passive checks by monitoring network traffic during website crawling, allowing for the identification of weaknesses without sending disruptive requests. The goal is to reduce alert fatigue by implementing fewer checks, reducing false positives, and aggregating true positives. The passive checks are primarily defined in YAML using a custom specification, with reu. Proxy-based DAST has been removed and replaced by this browser-based tool.
7/23/2026
This post details the evolution of GitLab's Dynamic Application Security Testing (DAST) to a new browser-based analyzer (DAST 2). It introduces passive checks that monitor network traffic during website crawling to identify weaknesses without sending disruptive requests. The aim is to reduce alert fatigue by implementing fewer checks, reducing false positives, and aggregating true positives. Passive checks are defined in YAML using a custom specification.
5/13/2024
This post announces the removal of proxy-based DAST in GitLab 17.0 and its replacement with the proprietary browser-based DAST tool. It details the migration process, configuration steps for automated and on-demand scans, and explains how the new DAST works, including its authentication, discovery, passive, and active checks. It also highlights the benefits of the new DAST, such as simulating real-world hacking, producing high-confidence findings, and covering OWASP Top 10 vulnerabilities.
10/19/2022
Introduced a new browser-based DAST analyzer that integrates passive checks by monitoring network traffic. This analyzer aims to reduce alert fatigue by implementing fewer checks, reducing false positives, and aggregating true positives. Passive checks are primarily written in YAML using a custom specification. The post details the history of DAST at GitLab, the challenges with the previous ZAP-based approach, and the technical decisions made to build the new analyzer.
10/27/2021
This post details GitLab's internal adoption of DAST 2, focusing on the migration from DAST 1. Key contributions include the move from `DAST_EXCLUDE_RULES` to `DAST_ONLY_INCLUDE_RULES` for simplified scan rule selection, enabling DAST auto-update by upgrading `DAST_VERSION` to `2`, and removing deprecated configuration variables like `DAST_AUTH_EXCLUDE_URLS`. The post highlights the benefits of vulnerability aggregation in DAST 2 for reducing noise and streamlining triage, as well as the advantages of the new browser-based crawler and improved configuration options. It also mentions identifying areas for improvement in DAST, such as misconfiguration detection and a reusable configuration section in the DAST template.
8/13/2021
This post introduces the concept of using analogies to help designers understand and design for highly technical spaces, specifically in the context of security technologies like SAST, DAST, and Fuzz testing. It provides a medical analogy to explain the functionalities of these security testing methodologies.
8/31/2020
This post details how to optimize DAST full scan duration for complex web applications by reducing the number of tested pages (using DAST_AUTH_EXCLUDE_URLS), populating the app with relevant test data (e.g., using review apps), and identifying/excluding irrelevant rules (using DAST_EXCLUDE_RULES). It also discusses parallelizing DAST jobs to further reduce pipeline duration.
8/21/2020
This post discusses the integration of developer-centric application security testing tools into the CI pipeline, specifically mentioning Software Composition Analysis (SCA), Dynamic Application Security Testing (DAST), and Secrets Detection. It highlights GitLab's DAST checks for Ultimate tier customers and StackHawk as a more robust alternative. The post outlines a playbook for implementing these tests, starting with local configuration, then non-blocking CI instrumentation, followed by bug triage, and finally switching to blocking tests. It also emphasizes the cultural shift required for security to become an enabler of rapid development.
5/3/2019
This post introduces the concept of "shift left" for application security testing in cloud-native environments. It emphasizes integrating security into the development lifecycle through DevSecOps, advocating for automated security scans at code commit. It highlights GitLab's review app feature for pre-merge testing and the use of Dynamic Application Security Testing (DAST) to scan these review apps. The post also touches on the importance of horizontal security coverage (application, container, orchestrator, access management) and the benefits of simplicity and integration in security tools.