Alexis Kestler
Hello friend! With data breaches often stemming from vulnerable web applications and APIs, securing them is mission critical these days. As an application security geek and expert, I wanted to share my in-depth thoughts on using Probely for DAST scanning.
Let‘s start with some context. Research shows that roughly one third of data breaches result from web app attacks. And a recent survey found 72% of organizations feel their applications are vulnerable. Here are some other eye-opening stats:
- – 40% of all vulnerabilities discovered affect web applications (Positive Technologies)
- – Web apps account for over 50% of vulnerability exploitations (Edgescan)
- – 75% of attacks target the application layer (Gartner)
With risks like data theft, service outages, regulatory fines, and reputation damage, securing web apps and APIs should be a top priority. This is where dynamic application security testing (DAST) tools like Probely come in.
What Makes Probely Unique
There are definitely other DAST scanners out there – so what makes Probely stand out? Based on my hands-on experience and analysis, Probely has two major advantages:
Unmatched Test Coverage
Many DAST tools struggle to adequately test modern web apps built with JavaScript frameworks like React and Angular. Their less sophisticated spiders have difficulty crawling and discovering pages, leaving major blindspots.
Probely‘s next-gen spider mimics real user behavior to achieve far superior coverage of complex web apps. Tables comparing coverage show Probely finding 2x or 3x as many pages compared to competitors. More discovered pages means more vulnerabilities detected.
Reduced False Positives
Traditional DAST tools are notorious for false positives – reporting vulnerabilities that don‘t actually exist. Sifting through these wastes huge amounts of time and causes "alert fatigue."
Probely minimizes false positives by providing supporting evidence for each finding. Rather than manually verifying hundreds of results, you can focus on addressing real issues backed by proof. This evidence-based approach is a true gamechanger.
Scanning Web Apps vs APIs
Probely can scan both traditional web applications as well as APIs and services. Here‘s a quick rundown of how it handles each:
Web Application Scanning
- – Maps site structure and functionality
- – Intelligently spiders single page apps
- – Checks page logic, parameters, etc.
- – Supports form auth, cookies, etc.
- – Assesses TLS, headers, CORS, and more
API Scanning
- – Imports OpenAPI spec to understand API structure
- – Validates schema compliance
- – Fuzzes parameters and payloads
- – Tests authentication methods
- – Checks CORS, rate limiting, etc.
Probely crawls and attacks sites the same way hackers do to uncover a wide range of vulnerabilities like SQLi, XSS, insecure configs, authentication flaws, and much more.
Integrating Security into DevOps Pipelines
A key benefit of Probely is how easily it fits into modern dev workflows. With its API-first design, Probely integrates with popular platforms like:
- – CI/CD – Jenkins, CircleCI, TravisCI, GitHub Actions
- – Issue/Project Tracking – Jira, Azure DevOps
- – ChatOps – Slack, Teams
- – Orchestrators – Kubernetes, CloudFormation
This means developers can execute DAST scans right from their pipelines and automatically sync results to their existing issue tracker. Security gets injected earlier without disrupting developer velocity.
Should You Ditch Pentesting for DAST?
Dynamic scanners like Probely complement rather than replace traditional penetration testing and static analysis. The combination of:
- – Automated DAST scans
- – Manual pentests
- – Static analysis
- – Developer training
Provides a layered security approach for maximum coverage of risks. Probely fills the gap for continuous, developer-driven testing that catches issues early and often.
The Verdict on Probely
After taking Probely for an extensive test drive, I‘m thoroughly impressed. Its powerful crawler, accurate findings, seamless integrations, and easy setup tick all the boxes for a modern DAST tool. Probely has become my go-to recommendation for boosting web application security.
DAST scanners might seem like "black magic" at first, but Probely democratizes robust application testing for dev and security teams alike. If your organization is struggling with web app security, I highly suggest giving Probely‘s free trial a spin!
