DAST that finds what your team would, on a schedule it can keep.
WASViking® runs deep deterministic engines against your live web applications and APIs. Coverage from SQL injection and XSS to JWT, GraphQL, SOAP and WebSocket, an authenticated session that all analyzers reuse, and an OAST collaborator we own.
Deep, deterministic, calibrated. Not a checklist scanner.
Every dynamic analyzer reads the per-host Environment Profile, so SQLi payloads adapt to the detected DBMS, XSS adapts to SPA rendering, and JWT adapts to JWKS placement. The result is fewer false positives and findings that hold up under engineering review.
SQLi
Five techniques across seven injection points. DBMS fingerprinting feeds payload selection. Per-finding evidence with raw HTTP transcript.
XSS
Reflected, stored, and DOM. SPA-aware via headless browser. Auth-context propagation so authenticated XSS does not look like unauthenticated noise.
JWT advanced
Alg confusion, weak secret recovery, JWKS proprietary-path discovery, form-login JWT auto-discovery, raw claim visibility under contract.
Injection classes
SSRF, CmdInj, Path Traversal/LFI, SSTI, Open Redirect, XXE, Insecure Deserialization, CRLF, RFI, IDOR, Race Conditions. One analyzer, shared context, shared OAST collaborator.
Component detection
Cloud-side fingerprint of frameworks, CMS, and libraries. Enriched with OSV.dev and CISA KEV. Pairs with premise-side SBOM for the full picture.
Sensitive files & headers
Soft-404 calibration with three canary shapes, content-type gating, per-kind positive fingerprints. OWASP header analyzer with severity calibration.
One form-login session. Every analyzer reuses it.
A shared form-login session is published through a per-scan shared context so the SQLi, XSS, JWT, GraphQL, and injection-class analyzers all consume the same authenticated cookies. No anti-brute-force lockout. No per-scanner login glue.
- AI Form Login Autofill detects login selectors via LLM, with a headless-browser SPA fallback
- 5-verdict compatibility classifier (compatible, captcha, SPA, multi-step, uncertain) recommends Form Login vs Bearer/Cookie
- Basic, Bearer, Header, Cookie modes carried through every request via the shared scan context
- Validated on DVWA and canonical SPA test targets
From login to scan, in one breath.
Operator selects Form Login. WASViking detects the selectors, classifies compatibility, authenticates once, and broadcasts the session to every analyzer enabled in the scan profile.
Our own OAST collaborator. Not a third party you cannot operate.
Blind SSRF, blind XXE, blind RFI, blind SSTI, and blind CmdInj rely on an out-of-band collaborator. Most automated DAST products either skip these classes or rent a third-party service. WASViking ships its own catcher with per-scan tokens, persists every interaction, and feeds them back into the injection-class analyzer.
- Per-scan token, single-tenant correlation
- HTTP and DNS interactions captured
- Native integration with the injection-class analyzer
- No third-party data leaving your tenant
[oast] interaction received from target IP
[injection-class] blind_ssrf confirmed
severity: high ยท cwe: CWE-918