🛡️ DAST Platform

A self-hosted Dynamic Application Security Testing (DAST) platform with AI-assisted scanning, real-time streaming, automated scheduling, and multi-tool orchestration — all through a single dark-themed UI.

---

📸 Screenshots

Dashboard	Scan Launch

Findings	Burp Suite Pro Scan

---

✨ Key Features

• 🤖 AI-Assisted Scanning — LLM-powered payload generation, finding triage, attack chain detection (OpenAI / AWS Bedrock / Ollama)
• 📡 Live Scan Streaming — real-time progress and logs via Server-Sent Events (SSE)
• 🔍 8 Integrated Security Tools — Nuclei, FFUF, Katana, GAU, Kiterunner, SQLMap, XSStrike, Burp Suite Pro
• 🎯 4 Scan Types — Recon, API Scan, Vulnerability Scan, Burp Suite Pro (via REST API)
• 🕷️ Burp Suite Pro Integration — trigger and retrieve full DAST scans via Burp's REST API
• ⚡ 3 Intensity Levels — Quick, Balanced, Deep
• 🔐 6 Auth Types — Form, JWT, Basic, Bearer, Cookie, OAuth2
• ⏰ Scan Scheduling — cron-based recurring scans with Celery Beat
• 🔔 Webhook Notifications — Slack, Teams, Discord, generic HTTP
• 📊 Report Export — JSON, HTML, PDF
• 🔄 Scan Comparison — track new vs fixed findings between scans
• 🎯 Scope Enforcement — whitelist/blacklist paths and domains
• 🔑 API Key Auth — CI/CD pipeline integration
• 💾 Incremental Saves — no data loss on worker crash

---

🧰 Tech Stack

Layer	Technology
Backend	Python 3.11, FastAPI
Task Queue	Celery 5 + Redis
Scheduler	Celery Beat
Database	PostgreSQL 16
Frontend	React 19, Vite
Real-time	Server-Sent Events (SSE)
AI Engine	OpenAI / AWS Bedrock / Ollama
Containers	Docker Compose

---

🔧 Tools Integrated

Tool	Purpose
Nuclei	CVE scanning, misconfigurations, exposures
FFUF	Directory/path fuzzing
Katana	JS-aware deep crawling
GAU	Historical URL discovery
Kiterunner	1.45M real API route brute-force
SQLMap	SQL injection confirmation
XSStrike	XSS confirmation
Burp Suite Pro	Full DAST scan triggered & retrieved via Burp REST API

---

🤖 AI Capabilities

Capability	Description
Smart Payloads	Technology-aware payload generation with WAF bypass
Finding Triage	Confidence scoring + false positive detection
Attack Chains	Combine low-severity findings into high-impact exploits
Response Analysis	Detect subtle vulnerability indicators
Remediation	Context-specific fix guidance with code examples
Strategy	Optimal scan configuration recommendations

---

🚀 Quick Start

Prerequisites

• Docker & Docker Compose
• Node.js 18+ (for frontend)
• (Optional) Burp Suite Pro with REST API enabled (for Burp scan type)
• (Optional) OpenAI API key or Ollama for AI features

1. Clone and configure

git clone https://github.com/Mr-root-2/DAST-Platform.git
cd DAST-Platform
cp .env.example .env
# Edit .env — set SECRET_KEY, POSTGRES_PASSWORD, ADMIN_DEFAULT_PASSWORD

2. Start backend services

docker compose up -d --build

Service	URL
Frontend UI	http://localhost:3000
Backend API	http://localhost:8000
API Docs (Swagger)	http://localhost:8000/docs
Celery Monitor	http://localhost:5555

3. Start the frontend

cd frontend
npm install
npm run dev

Frontend runs on http://localhost:3000

4. Login

Default credentials (set via ADMIN_DEFAULT_PASSWORD in .env):

• Username: admin
• Password: (value you set in .env)

5. (Optional) Enable Burp Suite Pro

Enable the REST API in Burp Suite Pro under User options → REST API, then set in .env:

BURP_API_URL=http://localhost:1337
BURP_API_KEY=your-burp-api-key-here

Once configured, select Burp Suite Pro as the scan type when launching a scan.

6. (Optional) Enable AI

# OpenAI
AI_PROVIDER=openai
AI_MODEL=gpt-4o-mini
AI_API_KEY=sk-your-key-here

# AWS Bedrock
AI_PROVIDER=bedrock
BEDROCK_MODEL_ID=anthropic.claude-3-5-sonnet-20241022-v2:0

# Local (free, no API key)
AI_PROVIDER=ollama
AI_MODEL=llama3
AI_OLLAMA_URL=http://localhost:11434

---

📁 Project Structure

dast-platform/
├── backend/
│   ├── ai/               # AI engine (OpenAI / Bedrock / Ollama)
│   ├── api/              # FastAPI routers
│   ├── core/             # Config, database, seeding
│   ├── models/           # SQLAlchemy models
│   ├── scanner/
│   │   ├── checks/       # Active checks (CORS, headers, IDOR, SQLi, XSS...)
│   │   ├── integrations/ # Tool wrappers (Nuclei, FFUF, SQLMap...)
│   │   ├── scan_types/   # Scan orchestration (recon, api, vuln)
│   │   └── severity.py   # Evidence-based severity calculator
│   ├── reporter/         # JSON / HTML / PDF report generation
│   ├── services/         # Scheduler, webhooks, compliance
│   └── worker/           # Celery app + tasks + beat schedule
├── frontend/             # React 19 + Vite SPA
│   └── src/
│       ├── pages/        # Dashboard, Scans, Findings, Reports...
│       └── components/   # Reusable UI components
├── deploy/
│   └── helm/             # Kubernetes Helm chart
├── docker-compose.yml
├── docker-compose.prod.yml
├── Dockerfile
└── requirements.txt

---

📡 API Reference

Auth

Method	Path	Description
POST	/api/auth/register	Register new user
POST	/api/auth/login	Login, get JWT

Core

Method	Path	Description
GET/POST	/api/targets/	Manage targets
POST	/api/scans/	Launch scan
GET	/api/scans/{id}/stream	SSE real-time progress
GET	/api/scans/{id}/findings	Get findings
POST	/api/reports/generate	Generate report

Extended

Method	Path	Description
GET/POST	/api/schedules	Scan scheduling
GET/POST	/api/webhooks	Webhook notifications
GET/POST	/api/api-keys	API key management
GET/POST	/api/templates	Scan templates
GET	/api/scans/{id}/compare/{other_id}	Diff two scans
POST	/api/ai/analyze	AI analysis on findings
GET	/health/detailed	Full health check

Full interactive docs at http://localhost:8000/docs

---

⚙️ Key Environment Variables

SECRET_KEY=                  # JWT signing key (required)
ADMIN_DEFAULT_PASSWORD=      # Initial admin password (required)
POSTGRES_PASSWORD=           # Database password (required)
DATABASE_URL=                # PostgreSQL connection string
REDIS_URL=                   # Redis connection string
AI_PROVIDER=                 # none | openai | bedrock | ollama
BURP_API_URL=                # Burp Suite Pro REST API (optional)
SCHEDULER_ENABLED=           # Enable cron-based scan scheduling
CORS_ORIGINS=                # Allowed frontend origins

See .env.example for the full list.

---

⚠️ Legal Disclaimer

This tool is intended for authorized security testing only. Only run scans against targets you own or have explicit written permission to test. Unauthorized scanning is illegal.

---

🤝 Contributing

Pull requests are welcome. For major changes, please open an issue first to discuss what you'd like to change.

---

Built with ❤️ for the security community