A Getting Started Guide to Veracode DAST Essentials

The Critical of Role of Dynamic Application Security Testing (DAST)

Web applications are one of the most common vectors for attacks, accounting for over 40% of breaches, according to Verizon's Data Breach Report. Dynamic application security testing (DAST) is a crucial technique used by development teams and security professionals to secure web applications in the software development lifecycle.

In fact, Veracode's State of Software Security Report reveals that 80% of web applications have critical vulnerabilities that can only be found with a dynamic application security testing solution. But modern software development practices prioritize tight deadlines. The demand is for faster releases without introducing vulnerabilities, making it difficult for teams to prioritize security. Security testing needs to work and scale within your DevOps speed and release frequency.

Getting Started with Veracode DAST Essentials

Veracode DAST Essentials is a dynamic application security testing tool that is easy to set up and rapidly scans your web applications and APIs for critical runtime vulnerabilities. Seamless integration into automated pipelines helps you deploy new features quicker, without disruption, and with peace of mind.

Unlike static application security testing, Veracode DAST Essentials simulates real-world attacks, mimicking the actions of malicious attackers to uncover exploitable vulnerabilities that could compromise your application's security. By mirroring real attackers' techniques, Veracode DAST Essentials helps you identify and address weaknesses that other security testing solutions may overlook.

In this blog, we'll walk you through the process of setting up your account (for free, no credit card required!), configuring scan targets, and interpreting results. Whether you're a seasoned developer or a security professional, this blog will help you get started with Veracode DAST Essentials quickly.

Step 1: Sign Up for Your Free Trial

To begin using Veracode DAST Essentials, sign up for a free, 14-day trial. Once you've created your account and set up your username and password, you can start scanning right away.

If you're already a Veracode Dynamic Analysis customer, simply log in to the Veracode platform with your credentials and access Veracode DAST Essentials under "Scans & Analysis."

Step 2: Create Your Scan Target

After logging in, you'll be redirected to the Veracode DAST Essentials home screen. Under your Target Lists, click on the "Add Target" button and select your target type: web application or API.

Next, provide specific details about your scan target. Add a descriptive target name and select the related protocol (HTTP or HTTPS). Enter the target URL or IP address that you want to scan. Optionally, you can specify a team name to better organize your scan targets.

Click "Next" to proceed.

Step 3: Select & Start Your Scan

Veracode DAST Essentials offers a "Quick Scan" option that provides rapid results in as early as 5 minutes. To proceed with a quick scan, ensure that your organization has the necessary rights to scan the content, then click "Next". If you require more comprehensive and in-depth scan capabilities, feel free to contact Veracode to explore how additional scan options can be added to your free trial experience.

Once you've configured your scan preferences, it's time to start your scan. Click on the "Run Analysis" tab to begin your scanning process. If needed, you can further customize your scan settings in the "Configure" tab.

Setting Up Authentication

Veracode DAST Essentials offers three authentication options to help you accurately crawl and access your target systems and applications:

System authentication: suitable for systems protected by Domain Authentication
Application authentication: used when your application requires a login form for user authentication.
Parameter authentication: ideal for applications that use GET parameters, HTTP headers, or cookies for authentication.

Automation & Integration

Veracode DAST Essentials seamlessly fits your development toolchain, allowing you to integrate security testing directly into automated pipelines and keep pace with fast-paced release cycles. Integration with popular CI/CD tools like Jenkins or GitHub is easy using custom scripts provided by Veracode.

You can schedule scans to run daily, weekly, or monthly by configuring your desired schedule in the "Configure Target > Schedules" section. By incorporating dynamic application security testing into your development workflow, you can identify runtime vulnerabilities as you code and earlier in the software development lifecycle, ensuring no critical vulnerabilities are released into production.

Interpreting Results

Veracode DAST Essentials provides real-time results in the "Findings" tab in your analysis run. By clicking on a finding, you can access the exact payloads used for the exploit and even replicate the findings using a curl request.

The "Scaner Status" diagram and tab allow you to monitor the scan progress to identify any errors while the scan is running. Veracode's documentation offers comprehensive guidance on troubleshooting common scan errors. The "Crawled URL" tab provides insights into the depth of the crawler's exploration within the application, helping you understand the scope of your analysis. Having greater control over your dynamic scans allows you to boost scanning with modularity, customization, and resilience.

Implementing Dynamic Applicaiton Security Testing with Veracode

Leveraging Veracode DAST Essentials to scan your web applications and APIs is a crucial step in securing your web assets because it will help you find and fix exploitable vulnerabilities that other application security testing tools will miss. If you need any additional support to get started with Veracode DAST Essentials, we have extensive documentation and on-demand experts to support you throughout the process.

Veracode DAST Essentials is part of Veracode's Intelligent Software Security platform, and can be used in conjunction with Veracode Static Analysis and Veracode Software Composition Analysis to help you find and fix flaws at every stage of the software development lifecycle. By partnering with Veracode, a leading application security provider, you can consolidate security vendors and simplify your security strategy while implementing dynamic application security testing that improves your web application security and better aligns security testing with your DevOps speed and release frequency.

Sign up for a free, 14-day trial of Veracode DAST Essentials to proactively identify and remediate critical vulnerabilities and enhance the security of your web applications and APIs in just a few clicks.