Outside-in testing
See the application the way an attacker does.
- Crawls web and single-page applications
- Tests REST and GraphQL APIs from their specifications
- Signed-in scanning with recorded login flows
HashGo ยท Dynamic application security testing
HashGo DAST
In development
Test the application that is actually running.
HashGo DAST probes your live web applications and APIs from the outside, signs in like a real user, and shows the request and response behind every finding.
In development. This page describes what we are building. Features may change before release.
Capabilities
What DAST will do.
Outside-in testing of live web apps and APIs, signed-in paths included, with the request behind every finding.
Proof, not guesses
Every finding comes with what was sent and what came back.
- Request and response for each finding
- Replay to confirm a fix
- Severity based on real exposure
Safe to run
Controls that keep testing inside the lines you draw.
- Rate limits and scan windows
- Scope rules for hosts and paths
- Separate staging and production profiles
How it works
Four steps, start to finish.
Add an application
Enter the URL or API specification and the login flow.
Set the scope
Choose hosts, paths, rate limits and a scan window.
Scan
The scanner crawls and tests the running application.
Confirm and fix
Review the evidence, fix, then replay to verify.
Coverage
What it covers.
- OWASP Top 10
- OWASP API Top 10
- REST
- GraphQL
- OpenAPI
- Single-page apps
- Login flows
SAST and DAST
Two views of the same risk.
HashGo SAST reads the code. HashGo DAST tests what is deployed. Most teams need both.
| HashGo SAST | HashGo DAST | |
|---|---|---|
| What it examines | Source code, without running it | The running application, from the outside |
| When it runs | On pull requests and in CI | Against staging or production |
| Typical findings | Injection, unsafe input handling, hardcoded secrets | Auth and session flaws, runtime injection, misconfiguration |
| Needs a deployed app | No | Yes |
What is DAST?
Dynamic application security testing checks a running application from the outside by sending requests and studying the responses, the same way an attacker would.
What kinds of issues will it find?
Authentication and session weaknesses, injection that only shows at runtime, missing security headers, exposed debug endpoints and server misconfiguration.
Is it safe to run against production?
Scans are designed to run with rate limits, scope rules and scan windows. Most teams start on staging and then schedule production scans.
Should I use DAST and SAST together?
Yes. SAST catches flaws in the code early, and DAST confirms how the deployed application behaves.
When will it be available?
It is in development. Write to us for early access.
Be first to try DAST.
Tell us about your environment and we will reach out when early access opens.
