Application Security
DAST tools that poke the app you already run (2026)
A 2026 shortlist of runtime scanners for apps you operate. Public docs, not a payload cookbook.
Expertise: Application Security · Level: Intermediate · 12 min read
A compiler clean build is not a running app.
The SAST report was green and the login still echoed a token. DAST hits a host you already run. It is complementary to the SAST list. It is not a license to scan a stranger.
Six scanners. One open daemon. One template engine. One human proxy. One newer desk. One classic CGI pass. One commercial proof. Own assets only. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| OWASP ZAP | Open DAST you can script | Apache-2.0 |
| Nuclei | Known checks on URLs you already have | MIT |
| Burp Suite | Human proxy on a flow you walk | Community + Professional |
| Caido | Newer proxy desk with a calmer UI | Proprietary (community tier) |
| Nikto | One dusty pass on a vhost you just stood up | GPL-2.0 |
| Invicti | Paid proof when legal wants a vendor | Commercial |
OWASP ZAP
Best for open DAST you can script
ZAP is desktop and daemon. Spider, AJAX spider, OpenAPI import, Automation Framework YAML. The HTML report is ugly and honest.
Key features
- Daemon and CI baseline
- OpenAPI import
- Automation Framework YAML
- Huge add-on market
Why we like it
This is the hidden gem. You can check the plan into git and run it against staging you own.
Limits
SPA crawls still lie. Java heap on large sites. Stay on hosts you operate.
Nuclei
Best for known checks on URLs you already have
Nuclei is a template engine. It is not a crawler. Pin template versions. Point it at an allowlisted URL list you own.
Key features
- YAML templates
- Fast on a URL list
- SARIF and JSON
- You pin the pack
Why we like it
When inventory already named the host, a known-check runner is the honest next step.
Limits
Not a full authenticated crawl. Easy to point at the wrong CIDR. Do not.
Burp Suite
Best for human proxy on a flow you walk
Community is the proxy. Professional adds the crawler and scanner. When a login has three redirects, a human still opens Burp.
Key features
- Intercepting proxy
- Extensions
- Pro scanner
- Enterprise for CI
Why we like it
A daemon cannot feel a broken wizard. Burp is the pair of hands.
Limits
Pro costs. Java desktop. Scope is a written list, not a feeling.
Caido
Best for newer proxy desk with a calmer UI
Caido is a newer intercepting proxy with a web UI and workflows. It is not a full DAST suite yet.
Key features
- Web UI proxy
- Workflows they document
- Growing plugins
- Community tier
Why we like it
Testers moved here because Burp felt heavy on a Thursday. I still keep Burp installed.
Limits
Younger scanner. Smaller extension set. Own hosts only.
Nikto
Best for one dusty pass on a vhost you just stood up
Nikto is a classic web server scanner. CGI and header checks. Loud. Useful once per host you own.
Key features
- Forgotten-file checks
- Perl CLI
- Tuning flags
- Text and HTML out
Why we like it
A new staging vhost still hides a phpinfo. Run it once. File the real tickets. Move on.
Limits
Dated signatures. Noise. Not a modern authenticated program.
Invicti
Best for paid proof when legal wants a vendor
Invicti, formerly Netsparker, sells proof-based scanning. The finding tries to demonstrate itself. Tickets come with the license.
Key features
- Proof-based findings
- Tickets and roles
- SaaS or engine
- Vendor on the call
Why we like it
A CISO sometimes needs a logo. Keep ZAP in CI because licenses expire and YAML does not.
Limits
Cost. Crawl tuning. We did not run a tenant.
What the internet thinks about DAST tools
DAST threads treat scope as the first control. We keep that line. A scanner is not a hunting license, and it is not a human.
alp1n3_eth on Hacker News, Apr 2025: “The two latter only work well when used in combination with manual methods though, as they won’t pick up business logic, auth bypass, MFLAC/IDOR, etc. on their own.”
Prove ZAP still publishes
Confirm ZAP still publishes. Import an OpenAPI for an app you own. Do not point a new daemon at a host you have never logged into.
curl -fsSIL https://www.zaproxy.org/ | head -n 8FAQs
Is scanning other people’s sites legal?
Not without written permission. These tools belong on staging, labs, and production you operate.
Does DAST replace SAST?
No. SAST names the sink in the PR. DAST hits the running app. Link both.
Can Nuclei replace a crawler?
No. Nuclei asserts known checks on URLs you already have.
Is this a scored bake-off?
No. Order is editorial. We will not publish a payload cookbook.
