dast-automation

DAST Automation with Playwright MCP

Thin router. Specific guidance lives in workflows/, methodology/, payloads/, and examples/. Read this file first, then lazy-load only the files you need for the task.

When to Use

• Operator asks for a DAST / dynamic security scan of one or more web apps.
• Blackbox external scan of a single domain.
• Greybox (authenticated) scan with provided credentials.
• Parallel scanning across a fleet of domains.
• Setting up continuous / scheduled DAST with baseline diffing.
• CI/CD integration to block regressions on new Critical/High issues.

Trigger Phrases

"scan ", "run DAST", "blackbox scan", "greybox scan", "authenticated pentest", "spider and test this app", "security-test these URLs", "weekly security scan", "continuous DAST".

When NOT to Use This Skill

• Source-code SAST / dependency CVEs → use sast-automation / sca-automation.
• Container image CVE scanning → use container-security.
• IaC / Terraform / K8s manifest misconfig scanning → use iac-security.
• Mobile app runtime testing (Frida, MASTG) → use mobile-security.
• Network/host hardening audit without web surface → use network-audit.
• Manual bug-bounty research on a single target → use this skill for surface mapping but switch to hackerone-research for narrative PoC work.

Decision Tree

Domains = 1 ──→ creds provided? ──→ no  → workflows/blackbox_single_domain.md
                                 └─→ yes → workflows/greybox_authenticated.md

Domains ≥ 2 ──→ one-shot scan ──→ workflows/multi_domain_parallel.md
            └→ recurring schedule ─→ workflows/continuous_scanning.md

Any mode ──→ emit schemas/finding.json → methodology/reporting.md

Parallelism Hints

Independent — run concurrently:

• Phase 0 recon tools: nmap, whatweb, ffuf, subfinder, root-level nuclei.
• Per-injection-class test batches (XSS, SQLi, SSRF, path traversal, CRLF) after crawl finishes.
• One sub-agent per domain in multi-domain mode.
• One sub-agent per low-priv account when running IDOR diff.