Share
## https://sploitus.com/exploit?id=45C98F0C-AC5F-5516-85F7-300907FDF5F5
# ๐ก๏ธ DAST Platform
A **self-hosted Dynamic Application Security Testing (DAST) platform** with AI-assisted scanning, real-time streaming, automated scheduling, and multi-tool orchestration โ all through a single dark-themed UI.
---
## โจ Key Features
- ๐ค **AI-Assisted Scanning** โ LLM-powered payload generation, finding triage, attack chain detection (OpenAI / AWS Bedrock / Ollama)
- ๐ก **Live Scan Streaming** โ real-time progress and logs via Server-Sent Events (SSE)
- ๐ **8 Integrated Security Tools** โ Nuclei, FFUF, Katana, GAU, Kiterunner, SQLMap, XSStrike, Burp Suite Pro
- ๐ฏ **3 Scan Types** โ Recon, API Scan, Vulnerability Scan
- โก **3 Intensity Levels** โ Quick, Balanced, Deep
- ๐ **6 Auth Types** โ Form, JWT, Basic, Bearer, Cookie, OAuth2
- โฐ **Scan Scheduling** โ cron-based recurring scans with Celery Beat
- ๐ **Webhook Notifications** โ Slack, Teams, Discord, generic HTTP
- ๐ **Report Export** โ JSON, HTML, PDF
- ๐ **Scan Comparison** โ track new vs fixed findings between scans
- ๐ฏ **Scope Enforcement** โ whitelist/blacklist paths and domains
- ๐ **API Key Auth** โ CI/CD pipeline integration
- ๐พ **Incremental Saves** โ no data loss on worker crash
---
## ๐งฐ Tech Stack
| Layer | Technology |
|-------|-----------|
| Backend | Python 3.11, FastAPI |
| Task Queue | Celery 5 + Redis |
| Scheduler | Celery Beat |
| Database | PostgreSQL 16 |
| Frontend | React 19, Vite |
| Real-time | Server-Sent Events (SSE) |
| AI Engine | OpenAI / AWS Bedrock / Ollama |
| Containers | Docker Compose |
---
## ๐ง Tools Integrated
| Tool | Purpose |
|------|---------|
| [Nuclei](https://github.com/projectdiscovery/nuclei) | CVE scanning, misconfigurations, exposures |
| [FFUF](https://github.com/ffuf/ffuf) | Directory/path fuzzing |
| [Katana](https://github.com/projectdiscovery/katana) | JS-aware deep crawling |
| [GAU](https://github.com/lc/gau) | Historical URL discovery |
| [Kiterunner](https://github.com/assetnote/kiterunner) | 1.45M real API route brute-force |
| [SQLMap](https://github.com/sqlmapproject/sqlmap) | SQL injection confirmation |
| [XSStrike](https://github.com/s0md3v/XSStrike) | XSS confirmation |
| [Burp Suite Pro](https://portswigger.net/burp/pro) | Full DAST via REST API |
---
## ๐ค AI Capabilities
| Capability | Description |
|-----------|-------------|
| Smart Payloads | Technology-aware payload generation with WAF bypass |
| Finding Triage | Confidence scoring + false positive detection |
| Attack Chains | Combine low-severity findings into high-impact exploits |
| Response Analysis | Detect subtle vulnerability indicators |
| Remediation | Context-specific fix guidance with code examples |
| Strategy | Optimal scan configuration recommendations |
---
## ๐ Quick Start
### Prerequisites
- Docker & Docker Compose
- Node.js 18+ (for frontend)
- _(Optional)_ Burp Suite Pro with REST API enabled
- _(Optional)_ OpenAI API key or Ollama for AI features
### 1. Clone and configure
```bash
git clone https://github.com/Mr-root-2/DAST-Platform.git
cd DAST-Platform
cp .env.example .env
# Edit .env โ set SECRET_KEY, POSTGRES_PASSWORD, ADMIN_DEFAULT_PASSWORD
```
### 2. Start backend services
```bash
docker compose up -d --build
```
| Service | URL |
|---------|-----|
| Frontend UI | http://localhost:3000 |
| Backend API | http://localhost:8000 |
| API Docs (Swagger) | http://localhost:8000/docs |
| Celery Monitor | http://localhost:5555 |
### 3. Start the frontend
```bash
cd frontend
npm install
npm run dev
```
Frontend runs on **http://localhost:3000**
### 4. Login
Default credentials (set via `ADMIN_DEFAULT_PASSWORD` in `.env`):
- **Username:** `admin`
- **Password:** _(value you set in `.env`)_
### 5. (Optional) Enable AI
```env
# OpenAI
AI_PROVIDER=openai
AI_MODEL=gpt-4o-mini
AI_API_KEY=sk-your-key-here
# AWS Bedrock
AI_PROVIDER=bedrock
BEDROCK_MODEL_ID=anthropic.claude-3-5-sonnet-20241022-v2:0
# Local (free, no API key)
AI_PROVIDER=ollama
AI_MODEL=llama3
AI_OLLAMA_URL=http://localhost:11434
```
---
## ๐ Project Structure
```
dast-platform/
โโโ backend/
โ โโโ ai/ # AI engine (OpenAI / Bedrock / Ollama)
โ โโโ api/ # FastAPI routers
โ โโโ core/ # Config, database, seeding
โ โโโ models/ # SQLAlchemy models
โ โโโ scanner/
โ โ โโโ checks/ # Active checks (CORS, headers, IDOR, SQLi, XSS...)
โ โ โโโ integrations/ # Tool wrappers (Nuclei, FFUF, SQLMap...)
โ โ โโโ scan_types/ # Scan orchestration (recon, api, vuln)
โ โ โโโ severity.py # Evidence-based severity calculator
โ โโโ reporter/ # JSON / HTML / PDF report generation
โ โโโ services/ # Scheduler, webhooks, compliance
โ โโโ worker/ # Celery app + tasks + beat schedule
โโโ frontend/ # React 19 + Vite SPA
โ โโโ src/
โ โโโ pages/ # Dashboard, Scans, Findings, Reports...
โ โโโ components/ # Reusable UI components
โโโ deploy/
โ โโโ helm/ # Kubernetes Helm chart
โโโ docker-compose.yml
โโโ docker-compose.prod.yml
โโโ Dockerfile
โโโ requirements.txt
```
---
## ๐ก API Reference
### Auth
| Method | Path | Description |
|--------|------|-------------|
| POST | `/api/auth/register` | Register new user |
| POST | `/api/auth/login` | Login, get JWT |
### Core
| Method | Path | Description |
|--------|------|-------------|
| GET/POST | `/api/targets/` | Manage targets |
| POST | `/api/scans/` | Launch scan |
| GET | `/api/scans/{id}/stream` | SSE real-time progress |
| GET | `/api/scans/{id}/findings` | Get findings |
| POST | `/api/reports/generate` | Generate report |
### Extended
| Method | Path | Description |
|--------|------|-------------|
| GET/POST | `/api/schedules` | Scan scheduling |
| GET/POST | `/api/webhooks` | Webhook notifications |
| GET/POST | `/api/api-keys` | API key management |
| GET/POST | `/api/templates` | Scan templates |
| GET | `/api/scans/{id}/compare/{other_id}` | Diff two scans |
| POST | `/api/ai/analyze` | AI analysis on findings |
| GET | `/health/detailed` | Full health check |
> Full interactive docs at **http://localhost:8000/docs**
---
## โ๏ธ Key Environment Variables
```env
SECRET_KEY= # JWT signing key (required)
ADMIN_DEFAULT_PASSWORD= # Initial admin password (required)
POSTGRES_PASSWORD= # Database password (required)
DATABASE_URL= # PostgreSQL connection string
REDIS_URL= # Redis connection string
AI_PROVIDER= # none | openai | bedrock | ollama
BURP_API_URL= # Burp Suite Pro REST API (optional)
SCHEDULER_ENABLED= # Enable cron-based scan scheduling
CORS_ORIGINS= # Allowed frontend origins
```
See `.env.example` for the full list.
---
## โ ๏ธ Legal Disclaimer
This tool is intended for **authorized security testing only**. Only run scans against targets you own or have **explicit written permission** to test. Unauthorized scanning is illegal.
---
## ๐ค Contributing
Pull requests are welcome. For major changes, please open an issue first to discuss what you'd like to change.
---
_Built with โค๏ธ for the security community_