Is there a Dynamic application security testing (DAST) tool which can run over dynamic html /JavaScript ajax applications? An open source option would be ideal - or if that does not exist, then a feature of an Enterprise tool would be the silver medal answer.

I have an ExtJS(JavaScript) application and tried using HP Fortify, but this tool sees only the index page and cannot run analysis of the application as a result.

I am not looking for a tool to provide protection by itself, but as one item in my tool belt to aid in providing some notification that obvious or glaring errors are present in the application (Other tools being code-reviews, penetration testing, etc) Any result set from the tool should inform the presence of problems, but I understand that no tool would be able to inform of their absence.

Also, any tool would be used in addition to concurrent penetration testing. Examples where you personally have experience with the tool will be given an answer, as after demo of IBM AppScan and discussion of NTO Spider, I still have nothing concrete (not marketing material) which indicates if this problem is just a rabbit hole.

  • 1
    Theres a product called NTO Spider which claims to do this. Get in touch with them and see what they say. – NULLZ Feb 28 '13 at 22:37
  • lo0.ro/2011/07/08/… – MacGyver May 4 '15 at 5:36
  • DOMinator Pro is the best for this purpose – atdre May 4 '15 at 22:06
  • Fortify is an SAST, not DAST – Neil Smithline May 5 '15 at 0:01

You are looking for the "silver bullet" for vulnerability scanning. Every vulnerability scanner claims to support JavaScript and Web Service based applications and its a complete and total lie. The truth is that this is a very difficult problem to solve, and a sales team will tell you anything to get you to open your wallet.

I test these applications using a blended manual and automated approach. The tool I use is Burp Intruder. I manually use the application with a browser, Burp tracks the requests and then I send them to intruder for fuzzing. If you are not comfortable building your own fuzz test cases and writing exploit code, then you should probably hire a professional penetration tester.

Just running a tool is not going to keep from getting hacked.

  • 1
    +1 for mentions of Burp Intruder and fuzz test cases, but I am not looking for silver bullet, just want assistance in spotting errors during release cycle so that this pen testing time isn't wasted finding things which an automation tool could find. – Thronk Mar 1 '13 at 20:04
  • 1
    Two years ago I saw researchers in Inria Rennes / Irisa's info sec team starting a bunch of projects on dynamic JS analysis. I also somewhat recall that Deian Stefan (scs.stanford.edu/~deian/)'s confinement tools for web apps support JS, but I'm not sure -- you'd need to check yourself. In any case the fact that the problem of analysing real-world JS apps is still current in research strengthens the suspicion that you won't find robust tools. – Steve DL May 4 '15 at 12:09

I think this is a very complex problem to solve, and any tools that we do have are relatively young. However, I think there are some good options out there, and some people pioneering in this area.

I think there are two aspects to your proposed problem:

  • The most obvious is crawling. The tool needs to be able to map out the whole application, including any server requests that it might make, in order to achieve good coverage/breadth. Traditionally this is simply achieved by crawling the HTML page for links and forms that point to more pages, but this becomes difficult with Ajax communications and single-page apps.

  • Furthermore, client-heavy applications, with a lot of Javascript code performing application logic in the user agent, are somewhat more likely to have security bugs in the client-side code itself. Flaws like DOM-based cross-site scripting can occur in any application that utilises client-side scripts, so tools ideally need the ability to spot vulnerabilities in this code as well.

Some tools have been shown to posses these abilities, and the common denominator is the ability to process Javascript. For instance, tools like Crawljax can be used by pentesters to map applications by actually processing each page as if it were in a browser (sometimes by actually loading it in a browser instance). We also have great utilities like PhantomJS that allows Javascript code to be processed in headless mode.

Here are a couple of tools that I've used which make some attempt to achieve the above - both are open source:

  • OWASP Zed Attack Proxy (ZAP) - OWASP ZAP features an AJAX crawler (in addition to a traditional crawler) which actually spawns browser instances in order to render and process pages and identify new paths through the application. I don't think the automated scanners will detect a lot of client-side code issues yet, but ZAP has at least introduced some good features for manually testing these.

  • Arachni - This is, hands-down, the best automated scanner I've used personally, and a really great project in my opinion. It seems to do a really good job of crawling most HTML5 applications and it uses PhantomJS to process the Javascript (headless). Testing for DOM-based XSS and similar also seems to work fairly well.

I don't think any tools are particularly polished when it comes to modern HTML5 web applications, but there are certainly some making headway, and they will only get better.

It should go without saying that automated testing tools are very limited in comparison to penetration testing, especially in the appsec arena, and should therefore be used in conjunction (as the OP has acknowledged). My answer has assumed that a fully automated solution is required. Where a human operator can be constantly involved, something like Burp Suite is definitely a good option.


IBM has a tool for analyzing Javascript and AJAX-y web applications for vulnerabilities. It's called Javascript Security Analyzer, and I think it is included in some versions of IBM AppScan. I have no personal experience with it, but some of their publications make it sound like it might be what you are looking for. It dynamically crawls your web site to find and exercise all Javascript code, then statically analyzes the Javascript and web pages for client-side XSS and other similar vulnerabilities.

I don't know of any open-source tool of this sort. Web pentesting tools typically don't have the ability to analyze the Javascript code for vulnerabilities, and finding client-side XSS can be non-trivial.

  • AppScan Standard edition claims to have some JavaScript security analysis, but the demo app available in the trial is a c#/asp.net app. As only this app can be scanned, I would need to take their word for it and buy a license to find out if it will actually work. After IT dept bought Fortify and were disappointed, not likely to buy anything else without 100% knowing it will provide value. You are spot on it's non-trivial – Thronk Mar 21 '13 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.