Introducing GitLab browser-based active checks in DAST
Oct 10, 2023Cameron Swords

Summary
Introduced browser-based active checks for DAST, starting with path traversal vulnerability detection (GitLab check 22.1) to replace ZAP alert 6. This enables more effective detection of vulnerabilities in modern web applications. Active checks are defined in YAML and can include match response, timing, and callback attack types. A worked example demonstrates how path traversal attacks are constructed and detected.
More from the Bug Triage and Reporting trail
- Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting
- Manage vulnerability noise at scale with auto-dismiss policies
- How to transform compliance observation management with GitLab
- Self-service security alert handling with GitLab's UAM
- How GitLab measures Red Team impact: The adoption rate metric