🌐 DAST · DYNAMIC APPLICATION SECURITY TESTING

EXPEDITE STRIKE™ — DAST & Web Interface Security Platform

1 WEB TARGETS STAGED

Live DAST Web Interface & API Exploitation Scanner (XTRIKE™ & Aegis.SOC™) · OWASP WSTG / Top 10 · Visual Exploit Evidence · 65,535 TCP/UDP Port Recon · Auto-Email Report

➔

Auto-Step

🌐 TARGET / LIVE WEBSITE:

🧪 OWASP & GITHUB BENCHMARK TEST SUITE (51 TARGETS)Select one or multiple OWASP / GitHub Vulnerable Application links below to test Enumeration (`XTRIKE-EnumCore™`), Exploitability Assessment (`Aegis.SOC-PentestValidator™`), and Live DAST Scanning:

OWASP WEB1. OWASP VWAD (Vulnerable Web Applications Directory)

https://vwad.owasp.org/

OWASP Official Web Directory Portal: WSTG-INFO / Header & Transport Posture / Directory Spidering

OWASP WEB2. OWASP Juice Shop (Official Project Portal)

https://owasp.org/www-project-juice-shop/

OWASP Project Site (Cloudflare / GitHub Pages): OWASP Top 10 Modern JS / SPA Security Benchmark Portal

OWASP WEB3. OWASP WebGoat (Official Project Portal)

https://owasp.org/www-project-webgoat/

OWASP Project Site (Java / Spring Benchmark Docs): OWASP Top 10 & WSTG Interactive Training Portal

OWASP WEB4. OWASP Security Shepherd (Official Project Portal)

https://owasp.org/www-project-security-shepherd/

OWASP Project Site (Web & Mobile AppSec): OWASP Web & Mobile AppSec Verification Portal

OWASP WEB5. OWASP Vulnerable Web Applications Directory Project

https://owasp.org/www-project-vulnerable-web-applications-directory/

OWASP Project Documentation Portal: Registry of Online, Offline & Containerized Vulnerable Apps

OWASP WEB6. OWASP crAPI (Completely Ridiculous API)

https://owasp.org/projects/crapi

OWASP API Security Top 10 Benchmark: BOLA, BFLA, Mass Assignment, SSRF & JWT API Security

DAST APP7. DVWA — Damn Vulnerable Web Application

https://github.com/digininja/DVWA

PHP / MySQL / MariaDB: SQLi, Command Injection, XSS, CSRF, File Inclusion, Brute Force

DAST APP8. bWAPP — buggy Web Application

https://github.com/raesene/bWAPP

PHP / MySQL (100+ Web Vulnerabilities): OWASP Top 10, SQL/HTML/LDAP/XML Injection, Heartbleed, Shellshock

DAST APP9. OWASP NodeGoat

https://github.com/OWASP/NodeGoat

Node.js / Express / MongoDB: NoSQL Injection, SSRF, Broken Auth, Insecure Deserialization, XSS

DAST APP10. Damn Vulnerable GraphQL Application (DVGA)

https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application

Python / Flask / Graphene GraphQL: GraphQL Introspection, Batching Attacks, Query Depth DoS, SQLi/OSi

DAST APP11. OWASP Benchmark Project

https://github.com/OWASP/Benchmark

Java Servlet Vulnerability Test Suite (2,740+ Test Cases): DAST/SAST Accuracy Calibration, CWE-89, CWE-78, CWE-79, CWE-22

DAST APP12. OWASP VulnerableApp

https://github.com/OWASP/VulnerableApp

Java Spring Boot Extensible DAST Target: Scanner Calibration for SQLi, XXE, JWT, SSRF, Command Injection, XSS

DAST APP13. OWASP Mutillidae II

https://github.com/OWASP/Mutillidae

PHP / MySQL Web Pentest Target: OWASP Top 10 2021/2017/2013, CORS, JWT, LFI/RFI, SQLi, XSS

DAST APP14. OWASP RailsGoat

https://github.com/OWASP/railsgoat

Ruby on Rails Vulnerable Web App: Mass Assignment, IDOR, SQLi, Command Injection, Session Management

DAST APP15. OWASP PyGoat

https://github.com/OWASP/pygoat

Python / Django Security Benchmark: SSTi, Insecure Pickle Deserialization, XXE, SQLi, Broken Access Control

DAST APP16. OWASP WebGoat.NET

https://github.com/OWASP/OWASPWebGoat.NET

ASP.NET Core / C# Ecommerce Target: .NET Deserialization, EF SQLi, XSS, Path Traversal, Auth Bypass

DAST APP17. OWASP CloudGoat

https://github.com/OWASP/CloudGoat

AWS Cloud Infrastructure Benchmark (Terraform): IAM PrivEsc, S3 Exposure, SSRF to IMDS, Lambda & ECS Compromise

DAST APP18. OWASP IoTGoat

https://github.com/OWASP/IoTGoat

OpenWrt Embedded Firmware Benchmark: OWASP IoT Top 10, Hardcoded Backdoors, UPnP/DNSMasq, Command Injection

DAST APP19. OWASP Serverless-Goat

https://github.com/OWASP/Serverless-Goat

AWS Lambda Serverless Application: Event Injection, Over-Privileged IAM Roles, Secrets in Env, DoS

DAST APP20. OWASP WrongSecrets

https://github.com/OWASP/wrongsecrets

Spring Boot / Docker / K8s / Vault / Cloud Secrets: Hardcoded API Keys, Git History Leaks, K8s ConfigMaps, Cloud KMS

DAST APP21. OWASP Juice Shop (Source Repository)

https://github.com/juice-shop/juice-shop

TypeScript / Node.js / Express / Angular / SQLite: 100+ Hacking Challenges across OWASP Top 10 & API Security

DAST APP22. OWASP Security Shepherd (Source Repository)

https://github.com/OWASP/SecurityShepherd

Java / Servlets / Docker Training Platform: Cross-Site Scripting, CSRF, SQLi, Session Fixation, Cryptographic Failures

DAST APP23. PortSwigger Web Security Academy

https://github.com/PortSwigger/web-security-academy

PortSwigger Burp Suite Web Security Labs: HTTP Request Smuggling, OAuth, Deserialization, Prototype Pollution, SQLi, XSS

DAST APP24. OWASP MASTG (Mobile App Security Testing Guide)

https://github.com/OWASP/owasp-mastg

iOS / Android / API Mobile Security Benchmark: MASVS / MASTG Mobile API Pinning, Auth, Storage & Reverse Engineering

DAST APP25. OWASP crAPI (Source Repository)

https://github.com/OWASP/crAPI

Python / Go / Java / React / Postgres Microservices: OWASP API Top 10: BOLA/IDOR, Mass Assignment, SSRF, JWT & NoSQLi

DAST APP26. OWASP Juice Shop (OWASP Org Repository)

https://github.com/OWASP/juice-shop

Node.js / Express / Angular / SQLite: OWASP Top 10 Modern Single-Page Application (SPA) & REST API

DAST APP27. OWASP DevSecOps (DSO)

https://github.com/OWASP/DSO

CI/CD Pipeline, SAST, DAST & Container Security: Supply Chain Security, Pipeline Hardening, Automated DAST/SAST Gates

DAST APP28. OWASP WebGoat (Official Source Repository)

https://github.com/WebGoat/WebGoat

Java 17 / Spring Boot Interactive Vulnerable App: SQLi, XXE, JWT Forgery, Insecure Deserialization, SSRF, IDOR, XSS

DAST APP29. Vulhub — Pre-Built Vulnerable Docker Environments

https://github.com/vulhub/vulhub

Docker-Compose Multi-CVE Reproduction Labs: Log4Shell, Spring4Shell, Struts2, Confluence, WebLogic, ActiveMQ RCEs

DAST APP30. VAmPI — Vulnerable REST API (OWASP API Top 10)

https://github.com/erev0s/VAmPI

Python Flask / OpenAPI v3 REST API: BOLA, Broken User Auth, Excessive Data Exposure, Mass Assignment, SQLi

DAST APP31. VAmPI-GraphQL — Vulnerable GraphQL API

https://github.com/erev0s/VAmPI-GraphQL

GraphQL / Node.js / Express API Target: GraphQL Introspection, Field Suggestion, Auth Bypass, Alias DoS

DAST APP32. DVWS — Damn Vulnerable Web Services

https://github.com/snoopysecurity/dvws

Node.js / REST / SOAP / XML / JWT Web Services: XXE, SSRF, Command Injection, JWT Secret Brute-Force, CORS Misconfig

DAST APP33. DVWA (EthicalHack3r Original Repository)

https://github.com/ethicalhack3r/DVWA

PHP / MySQL Classic Vulnerable Web Application: SQL Injection, Blind SQLi, OS Command Injection, File Upload, XSS, CSRF

DAST APP34. Commix — OS Command Injection Exploitation Suite

https://github.com/commixproject/commix

Python Command Injection Testing & Vulnerable Testbeds: Classic & Blind Time-Based/File-Based OS Command Injection (CWE-78)

DAST APP35. OWASP SSTI (Server-Side Template Injection)

https://github.com/OWASP/SSTI

Jinja2 / Twig / Freemarker / Velocity Template Engines: Server-Side Template Injection (CWE-1336) Sandbox Escape & RCE

DAST+SAST36. OWASP VulnerableApp (Official Project Portal)

https://owasp.org/www-project-vulnerableapp/

OWASP Foundation DAST/SAST Combined Portal: Unified DAST + SAST Vulnerability Scanner Evaluation Portal

DAST+SAST37. OWASP Benchmark (Official Project Portal)

https://owasp.org/www-project-benchmark/

OWASP Foundation Accuracy Benchmark Portal: True Positive / False Positive (YouDen Index) Calibration for DAST & SAST

DAST+SAST38. OWASP BenchmarkJava

https://github.com/OWASP/BenchmarkJava

Java Servlets / Spring (2,740+ Annotated Test Cases): Combined DAST + SAST Precision & Recall Benchmark Suite

DAST+SAST39. OpenSSF CVE Benchmark

https://github.com/ossf-cve-benchmark/ossf-cve-benchmark

200+ Real-World JavaScript / TypeScript CVEs: Historical Real-World CVE Reproduction & Tool Evaluation

DAST+SAST40. Vulnerable-Code SAST-Benchmark

https://github.com/vulnerable-code/SAST-Benchmark

Multi-Language Vulnerable Code & Web App Corpus: Cross-Language SAST & DAST Vulnerability Correlation

SAST BENCH41. EyeballVul — Future-Proof Vulnerability Benchmark

https://github.com/timothee-chauvin/eyeballvul

Stream-Updated Open-Source CVE Benchmark: LLM & SAST Vulnerability Detection on Real-World Commits

SAST BENCH42. IRIS — LLM-Assisted Static Analysis Benchmark

https://github.com/iris-sast/iris

CodeQL + Neuro-Symbolic LLM Taint Analysis: Whole-Repository CWE Detection & False-Positive Filtering

SAST BENCH43. RivalSecurity SASTBench

https://github.com/RivalSecurity/sastbench

SAST Tool Evaluation & CWE Triage Framework: Benchmarking Static Analysis Engines Across OWASP Top 10

SAST BENCH44. Bearer — SAST & Data Security Posture Scanner

https://github.com/Bearer/bearer

Ruby / JS / TS / Go / Python / Java Dataflow SAST: Sensitive Data Flow, Privacy Leakage & OWASP Top 10 SAST Rules

SAST BENCH45. GitHub CodeQL — Semantic Code Analysis Engine

https://github.com/github/codeql

CodeQL Queries & Security Suites (C/C++, C#, Go, Java, JS, Python, Ruby): Variant Analysis, Taint Tracking & Zero-Day CVE Query Packs

SAST BENCH46. Semgrep — Fast Polyglot Static Analysis Engine

https://github.com/semgrep/semgrep

OCaml / Python AST Pattern & Taint Analysis (30+ Languages): Custom Security Guardrails, Supply Chain & API Route Auditing

SAST BENCH47. Semgrep Rules — Official Community Security Registry

https://github.com/returntocorp/semgrep-rules

3,000+ YAML SAST Rules Mapped to OWASP & CWE: Framework-Specific Vulnerability Patterns & Hardening Checks

SAST BENCH48. Find Security Bugs — Java / Kotlin Bytecode SAST

https://github.com/find-sec-bugs/find-sec-bugs

SpotBugs Plugin for Java EE, Spring, Android & Scala (140+ Patterns): JVM Bytecode Injection, Crypto Weaknesses & Deserialization Sinks

SAST BENCH49. SpotBugs — Static Bytecode Analyzer for Java

https://github.com/spotbugs/spotbugs

Java Bytecode Defect & Security Pattern Detector (400+ Bug Patterns): Null Dereference, Concurrency Flaws & Malicious Code Vulnerabilities

SAST BENCH50. Golang Security Checker (gosec)

https://github.com/securego/gosec

Go AST Security Scanner (G101–G602 Rules): Go SQLi, Command Execution, Weak TLS/Crypto & File Traversal

SAST BENCH51. Analysis-Tools-Dev — Static Analysis Directory

https://github.com/analysis-tools-dev/static-analysis

Comprehensive Catalog of SAST & Linters Across All Programming Languages: Multi-Language Static Code Analysis & Security Tooling Reference

1. XTRIKE-NetRecon™ (Nmap)Nmap NSE v7.94 · TA0043

STANDBY

2. Aegis.SOC-VulnCore™ (OpenVAS/Nessus)OpenVAS 22.4 & Nessus 10.7

STANDBY

3. XTRIKE-WebPulse™ (OWASP ZAP)OWASP ZAP v2.14 · WSTG

STANDBY

4. XTRIKE-StrikeFuzzer™ (Burp)Burp Suite v2023.10 · OAST/Fuzz

STANDBY

5. Aegis.SOC-Apex™ (Verify/CWE)40-CWE & MITRE 14 · TA0004

STANDBY

0 events

PTES & NIST SP 800-115 Multi-Engine Brain is ready. Click [Launch PTES / NIST Scan (1 URLs)] to step through Nmap ➔ OpenVAS ➔ OWASP ZAP Top 10 (A01–A10) ➔ Burp ➔ Privilege Escalation & Lateral Movement ➔ Post-Assessment & Printable Report.

VALIDATED FINDINGS

READY FOR PTES / NIST AUDIT

STANDARD & SCOPE

PTES + NIST 800-115

1 Scoped Customer URLs · A01–A10

Aggregated Verified Findings (0)

PTES / NIST / OWASP Top 10 Ledger Ready

Start an exhaustive scan or open the Validated Report tab to view and print the PTES + NIST SP 800-115 + OWASP Top 10 analysis.