Security requirements verified with DAST

In this page, you can see the security requirements assessed by Fluid Attacks' dynamic application security testing (DAST), differentiating by the technology supported by the scanner.

Want to run DAST scans on your own? Learn how in DAST scanner configuration file.

APK

Scanner method name	Related security requirement verified
APK_BACKUPS_ENABLED	185. Encrypt sensitive information 266. Disable insecure functionalities
APK_DEBUGGING_ENABLED	077. Avoid disclosing technical information 078. Disable debugging events
APK_EXPORTED_CP	096. Set user's required privileges 176. Restrict system objects 264. Request authentication 320. Avoid client-side control enforcement
APK_UNSIGNED	122. Validate credential ownership 173. Discard unsafe inputs 178. Use digital signatures 320. Avoid client-side control enforcement
FRAGMENT_INJECTION	266. Disable insecure functionalities 173. Discard unsafe inputs
IMPROPER_CERTIFICATE_VALIDATION	266. Disable insecure functionalities
NOT_VERIFIES_SSL_HOSTNAME	266. Disable insecure functionalities
SOCKET_GET_INSECURE	183. Delete sensitive data securely
WEBVIEW_VULNS	266. Disable insecure functionalities

DNS

Scanner method name	Related security requirement verified
CHECK_DNS_RECORDS	062. Define standard configurations 273. Define a fixed security suite

HTTP

Scanner method name	Related security requirement verified
CONTENT_SECURITY_POLICY	062. Define standard configurations 117. Do not interpret HTML code 175. Protect pages from clickjacking 349. Include HTTP security headers
DATE	075. Record exceptional events in logs 320. Avoid client-side control enforcement
HTTP_ACCESS_CONTROL_ALLOW_METHODS_INSECURE	266. Disable insecure functionalities
HTTP_PERMISSIONS_POLICY_HEADER_NOT_PRESENT	062. Define standard configurations 175. Protect pages from clickjacking 266. Disable insecure functionalities 349. Include HTTP security headers
HTTP_SERVER_HEADER_LEAKED	077. Avoid disclosing technical information 176. Restrict system objects
HTTP_X_ASPNET_MVC_VERSION_HEADER_LEAKED	077. Avoid disclosing technical information 176. Restrict system objects
HTTP_X_ASPNET_VERSION_HEADER_LEAKED	077. Avoid disclosing technical information 176. Restrict system objects
HTTP_X_BACKEND_SERVER_HEADER_LEAKED	077. Avoid disclosing technical information 176. Restrict system objects
HTTP_X_POWERED_BY_HEADER_LEAKED	077. Avoid disclosing technical information 176. Restrict system objects
HTTP_X_XSS_PROTECTION_ENABLED	062. Define standard configurations 175. Protect pages from clickjacking 266. Disable insecure functionalities 349. Include HTTP security headers
LOCATION	173. Discard unsafe inputs 324. Control redirects
REFERRER_POLICY	062. Define standard configurations 349. Include HTTP security headers
SET_COOKIE_HTTPONLY	029. Cookies with security attributes
SET_COOKIE_SAMESITE	029. Cookies with security attributes
SET_COOKIE_SECURE	029. Cookies with security attributes
STRICT_TRANSPORT_SECURITY	062. Define standard configurations 181. Transmit data using secure protocols 349. Include HTTP security headers
SUB_RESOURCE_INTEGRITY	178. Use digital signatures 262. Verify third-party components 330. Verify Subresource Integrity
UPGRADE_INSEC_REQ	062. Define standard configurations 117. Do not interpret HTML code 175. Protect pages from clickjacking 349. Include HTTP security headers
VIEW_STATE	026. Encrypt client-side session information
WWW_AUTHENTICATE	030. Avoid object reutilization 228. Authenticate using standard protocols 319. Make authentication options equally secure
X_CONTENT_TYPE_OPTIONS	062. Define standard configurations 349. Include HTTP security headers

SSL

Scanner method name	Related security requirement verified
CBC_ENABLED	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
FALLBACK_SCSV_DISABLED	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
FREAK_POSSIBLE	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
HEARTBLEED_POSSIBLE	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
PFS_DISABLED	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
SSL_CERTIFICATE_EXPIRED	266. Disable insecure functionalities
SSL_SELF_SIGNED_CERTIFICATE	266. Disable insecure functionalities
SSLV3_ENABLED	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TLSV1_1_ENABLED	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TLSV1_2_OR_HIGHER_DISABLED	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TLSV1_3_DOWNGRADE	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
TLSV1_ENABLED	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions
WEAK_CIPHERS_ALLOWED	148. Set minimum size of asymmetric encryption 149. Set minimum size of symmetric encryption 150. Set minimum size for hash functions 181. Transmit data using secure protocols 336. Disable insecure TLS versions

Free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.

Security requirements verified with DAST | Fluid Attacks Help

Security requirements verified with DAST

APK

DNS

HTTP

SSL