Website / web app scanning (DAST)

Dynamic Application Security Testing (DAST) probes a live web application from the outside — no source code required — to find vulnerabilities that only appear at runtime.

It complements SAST: where SAST reads the code, DAST exercises the deployed app and its real configuration.

SecNxt crawls the target URL to discover pages, forms and endpoints — seeding from the homepage, robots.txt, sitemap.xml, security.txt and inline script/form/fetch URLs, then crawling a second level deep — and safely sends crafted requests to detect issues like injection, misconfiguration and broken authentication.

The Deep profile adds active and blind testing. It confirms reflected XSS using context-aware payloads (HTML, attribute, JS-string and SVG contexts) and re-checks for stored XSS, and proves SQL injection four ways: error-based, UNION-based (reflected sentinel), time-based blind and boolean-blind. It also catches open redirect, template injection, path traversal, CRLF and — uniquely — blind vulnerabilities via an out-of-band (OAST) callback system for blind SSRF and server-side injection. Form parameters are fuzzed across the HTTP method matrix (GET query strings and POST/PUT/PATCH request bodies).

Confirmed behaviours are recorded as findings with reproduction details and severity. Reflected/stored reflections, UNION sentinels, out-of-band callbacks, time-based delays and boolean differentials are marked as 'Verified' because each is a reproducible proof, not just a signal.

1. 1Choose 'Website URL Scan' on the New scan screen.
2. 2Enter the URL of the running application.
3. 3Provide authentication details if you need to test logged-in areas.
4. 4Select the Deep profile to enable active fuzzing and out-of-band blind detection.
5. 5Run the scan and review the findings as they stream in.

• Testing a staging environment before a release.
• Validating that a deployed configuration is actually secure.
• Finding issues that only exist at runtime.
• Catching blind SSRF / blind SQL injection that error-based scanners miss.

• Always scan an environment you are authorised to test.
• Authenticated scans find far more — supply credentials where possible.
• Use the Deep profile for the strongest coverage: blind detection and out-of-band testing only run there.

Can I scan internal applications?

Yes, using a self-hosted runner inside your network so the target never has to be exposed publicly.

What is out-of-band (OAST) testing?

Some vulnerabilities are 'blind' — the app never shows the result in its response. SecNxt injects a unique callback URL into the target; if the target's server reaches out to that URL, that connection is hard proof of a blind SSRF or server-side injection. This is the automated equivalent of a tester's Burp Collaborator. Note it complements, but does not replace, a human tester driving manual tools.