Dastardly by PortSwigger is a free, lightweight web application security scanner designed for integration into CI/CD pipelines. It assesses applications externally, mimicking an attacker, and provides accuracy beyond most static analysis tools. Dastardly scans take no longer than 10 minutes and are completely free to use with no restrictions on the number of applications or scans. It uses a free version of the same browser-powered scanning engine as Burp Suite Professional and Burp Suite Enterprise Edition, packaged for easier integration into CI/CD pipelines. Dastardly performs dynamic (DAST) security testing, examining applications externally to reduce false positives compared to static (SAST) methods. It reports findings in JUnit XML format, compatible with most CI tools, and provides actionable advice from the Web Security Academy for code adjustments. Dastardly can scan any deployed web app where a container can be run and is platform-independent. By default, it will fail the pipeline build if it finds any vulnerabilities with a severity level higher than INFO (LOW, MEDIUM, or HIGH). Dastardly cannot navigate login mechanisms, so authentication should be disabled during scans. It detects vulnerabilities that SAST will not find and produces fewer false positives by examining an application from the outside in, like an attacker. This approach saves time when investigating scan results and helps detect vulnerabilities that might be missed by other methods.
