Browser-based DAST Analyzer

13 posts · May 2019 – Jul 2026

What this trail covers

GitLab DAST continues to evolve, with this post detailing its comprehensive capabilities, including runtime vulnerability detection, seamless CI/CD integration for shift-left security, and compliance assurance. It elaborates on passive vs. active scanning methodologies and provides detailed guidance on authentication configuration for achieving complete security coverage. The post also highlights the Tanuki Shop demo application as a practical example of DAST implementation within CI/CD pipelines.

All GitLab trails

Jul 2026Application security testingThis post details the evolution of GitLab's Dynamic Application Security Testing (DAST) to a new browser-based analyzer (DAST 2). It introduces passive checks that monitor network traffic during website crawling to identify weaknesses without sending disruptive requests. The aim is to reduce alert fatigue by implementing fewer checks, reducing false positives, and aggregating true positives. Passive checks are defined in YAML using a custom specification.
Sep 2025A comprehensive guide to GitLab DASTThis post provides a comprehensive overview of GitLab DAST, detailing its benefits for runtime vulnerability detection, shift-left security integration, and compliance. It elaborates on the differences between passive and active scans and offers detailed examples of authentication configuration within CI/CD pipelines, including specific selectors for login forms and the use of DAST_AUTH_REPORT for authentication success verification. The Tanuki Shop demo application is presented as a practical example.
May 2024Detect application vulnerabilities with GitLab’s browser-based DASTThis post details the deprecation and removal of proxy-based DAST in favor of a new, proprietary browser-based DAST analyzer. It explains the technical reasons for the shift, including the limitations of legacy crawlers for modern web applications. It provides migration guidance for users of proxy-based DAST, including configuration recommendations and the process for on-demand scans. The post also outlines how the new DAST works, including its authentication, discovery, passive, and active check phases, and highlights its benefits such as simulating real-world attacks and providing high-confidence findings.
Nov 2023Tips to configure browser-based DAST scansThis post provides detailed configuration guidance for GitLab's browser-based DAST analyzer, focusing on authentication scenarios. It introduces and explains the usage of specific CI/CD variables like DAST_USERNAME, DAST_PASSWORD, DAST_AUTH_URL, DAST_WEBSITE, DAST_USERNAME_FIELD, DAST_PASSWORD_FIELD, DAST_SUBMIT_FIELD, DAST_FIRST_SUBMIT_FIELD, DAST_BROWSER_PATH_TO_LOGIN_FORM, DAST_BROWSER_ACTION_STABILITY_TIMEOUT, and DAST_BROWSER_MAX_RESPONSE_SIZE_MB. It also highlights the importance of setting adequate job and pipeline timeouts and introduces the DAST authentication report and analyzer logs for troubleshooting.
Oct 2023Introducing GitLab browser-based active checks in DASTThis post introduces the replacement of ZAP alert 6 (path traversal) with a new GitLab active check (22.1) within the browser-based DAST analyzer. It details how active checks work, including match response, timing, and callback attacks, and provides a YAML definition example for the path traversal check. The post also explains how to opt out of these new checks and includes a worked example of a path traversal attack detection.
Advertisement
Oct 2022Introducing browser-based DAST and integrated passive checksThis post announces the full integration of passive checks into GitLab's new browser-based DAST analyzer. It details the history of DAST at GitLab, the challenges of dynamic scanning in CI/CD, and the motivation for building a new browser-instrumented engine. The new engine uses ZAP as a proxy but processes crawling and passive checks internally. The post highlights the reduction of alert fatigue and false positives through selective check implementation, aggregation of true positives, and removal of outdated checks. It also introduces the YAML-based configuration system for passive checks, providing an example for the X-Content-Type-Options header.
Oct 2021How we’re using DAST 2 for easier scan configuration and reduced noiseThis post details the migration of GitLab's DAST CI job configuration from DAST 1 to DAST 2. Key technical contributions include: 1. Transitioning from `DAST_EXCLUDE_RULES` to `DAST_ONLY_INCLUDE_RULES` for more efficient and stable scan rule selection. 2. Enabling DAST auto-update by pinning the analyzer to version 2, leveraging the new configuration options. 3. Removing deprecated DAST configuration variables like `DAST_AUTH_EXCLUDE_URLS`. The post also highlights the benefits of vulnerability aggregation in DAST 2 for reducing noise in the vulnerability dashboard and discusses the identification of new features and bugs through dogfooding.
Aug 2020How to configure DAST full scans for complex web applicationsThis post details how to optimize DAST scan duration by excluding low-risk pages using DAST_AUTH_EXCLUDE_URLS, populating applications with test data by spinning up fresh review apps, and identifying/excluding irrelevant rules using DAST_EXCLUDE_RULES. It also touches on parallelizing DAST jobs.
Aug 2020How Developer-Centric AppSec Testing Transforms DevOps TeamsThis post advocates for integrating developer-centric application security testing tools into the CI pipeline. It suggests three types of tests: Software Composition Analysis (SCA) to identify vulnerable open-source dependencies, Dynamic Application Security Testing (DAST) to test running applications, and secrets detection to find leaked credentials. It outlines a four-step getting started playbook: local testing and configuration, non-blocking CI instrumentation, bug triage, and finally switching to blocking tests. The post emphasizes the cultural shift required for security to become an enabler rather than a blocker in fast-paced DevOps environments.
Aug 2019SAST & DAST: Key security tests for development workflowsThis post introduces Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) as key components of application security testing (AST) within the software development lifecycle. It explains that SAST analyzes source code for vulnerabilities before deployment, while DAST analyzes running web applications for runtime vulnerabilities. The post highlights GitLab's integration of SAST to provide automated vulnerability summaries in merge requests and DAST to run live attacks on review apps during QA. It emphasizes the importance of using both SAST and DAST together for a comprehensive security strategy and suggests integrating them into CI/CD pipelines.
May 2019A shift left strategy for the cloudThis post introduces the concept of "shift left" for application security testing in cloud-native environments. It emphasizes integrating security into the development lifecycle through DevSecOps, advocating for automated security scans at code commit. It highlights GitLab's review app feature for pre-merge testing and the use of Dynamic Application Security Testing (DAST) to scan these review apps. The post also touches on the importance of horizontal security coverage (application, container, orchestrator, access management) and the benefits of simplicity and integration in security tools.