Dynamic Application
Security Testing

SAST (Static Application Security Testing) analyzes your source code without running it — it finds vulnerabilities early, at the code level. DAST (Dynamic Application Security Testing) tests your running application from the outside, the way a real attacker would, so it finds runtime issues like server misconfigurations, authentication flaws, and exploitable injection points that only appear in a live environment. Offensive360 includes both in one platform, so you cover code and runtime without buying two tools.

The engine runs more than 40 active exploit checks and 19 passive analyzers on every scan. Active checks cover SQL injection (error, boolean and time-based), reflected, stored, DOM-based and blind XSS, SSRF, XXE, OS command injection, path traversal, server-side and client-side template injection, SSI, LDAP, XPath, NoSQL and expression-language injection, CRLF and email-header injection, host-header injection, HTTP parameter pollution, prototype pollution, insecure deserialization, HTTP request smuggling, web cache poisoning, CSRF, JWT misconfiguration and replay, session fixation, unrestricted file upload, exposed files and source code, default credentials, password-reset poisoning, open redirects, weak TLS, GraphQL introspection, IDOR/BOLA, missing function-level authorization (BFLA), mass assignment, and API inventory and resource-consumption weaknesses. Passive analyzers cover CORS, security headers, cookie flags, clickjacking, secrets in responses and URLs, version disclosure, cache control, subdomain takeover, anti-CSRF tokens, error leakage, directory listing, mixed content, exposed source maps, session-token entropy, missing login rate limiting, form security, and vulnerable or outdated components. Fingerprint packs add known-CVE matching for WordPress, Joomla, Drupal and common frameworks.

Yes. Offensive360 DAST supports authenticated scanning: form-based login, token and cookie sessions, multi-step login flows, and role-based testing across privilege levels. Since most of an application’s attack surface sits behind authentication, this typically raises coverage from roughly 20% to 90% of the application.

Yes. A headless-Chromium crawler renders JavaScript-heavy single-page applications to discover the routes, forms and API calls a plain HTTP spider never sees. GraphQL endpoints are checked for introspection exposure, and both REST and GraphQL APIs are tested for injection, broken object-level authorization, mass assignment and missing resource-consumption controls. Blind and out-of-band vulnerabilities — SSRF, XXE, blind XSS — are confirmed through a self-hosted out-of-band (OAST) callback service, so no third-party collaborator server is involved.

Yes. Applications with chatbots, LLM-backed APIs, or RAG features have a new attack surface that traditional scanners miss. Offensive360 tests AI-powered applications against the OWASP Top 10 for LLM Applications (2025) — prompt injection (the #1 LLM risk), jailbreaks, system prompt leakage, improper output handling, and sensitive information disclosure — alongside the classic web and API vulnerability classes.

Findings are validated with real exploit payloads and reported with the request/response evidence that proves them — you see exactly what was sent and what came back. Post-scan validators re-check every finding, an AI-assisted triage pass flags anything that looks like a false positive, and every engine release must produce zero findings against clean control applications before it ships. Safe mode is on by default, so validation never damages the target.

They share one engine. A DAST scan is the point-in-time, deterministic test of a target. The AI Pentester runs a full, authorization-gated engagement on top of it, with human approval before exploitation. Autonomous Red Teaming runs continuously inside an enforced scope guard and proves exploitability with non-destructive proof-of-exploit. Attack Surface Management (ASM) discovers the external assets — subdomains, services, certificates, leaked credentials — that can then be handed to any of the three for authorized testing. All of it lives in one dashboard, which separates the findings-weighted Scan Risk Index from the ASM-derived External Exposure Risk.

Yes. DAST ships inside the same virtual appliance as SAST, MAST and ASM — an OVA for your data center or an Azure VHD image for your own cloud tenant — and runs fully offline in air-gapped networks. Targets, findings and evidence never leave your environment.