DAST¶

#36 · Elevate Your DAST Scans with Dynamic Authentication Token Generation! 🌟🔒

Exciting news for all Escape users! We're rolling out a game-changing enhancement on the scan authentication feature: Dynamic Authentication Token Generation for DAST scans. This feature is about empowering your scans with real-world authentication scenarios.

What's New?

• Generate Authentication Credentials Automatically: Start every DAST scan with fresh, automatically generated credentials. Whether it's tokens or other forms of authentication, we've got you covered.
• Run Scans with Multiple User Profiles: Simulate different user levels in your scans - from admins to standard users. This allows you to comprehensively test your APIs from various security standpoints.
• Effortless Authentication for Any API: With our versatile framework, authenticate against any type of API – REST, GraphQL, or anything else.

Key Enhancements:

• Workflow-Driven Authentication: Tailored to fit a variety of server interactions, ensuring seamless token generation and application.
• Credential Management: Efficient extraction and injection of authentication data into your scans.
• Detailed Logging: Track every step of the authentication process with our comprehensive logs.
• Session Management and Refresh: Manage and automatically refresh tokens based on their TTL, or configure manually if needed.

Supported Authentication Methods:

• AWS Cognito
• Basic
• cURL & cURL Sequence
• Digest
• GraphQL
• Headers
• HTTP
• OAuth (Client Credentials, User Password)
• Webdriver
• Custom Workflows involving multiple HTTP Requests and Webdriver actions

Dive Into Action:

This update opens up a new realm of possibilities for your API security testing. By incorporating real-world authentication scenarios, your DAST scans are now more thorough and realistic than ever. Get ready to unleash the full potential of your API security with Escape!

#34 · Enhanced Scanning Capabilities through Insomnia Collections & WP-JSON Schema support 🌐

We're excited to share a significant expansion in our Dynamic Application Security Testing (DAST) capabilities. Escape now supports a broader range of input formats, catering to diverse API testing needs and environments. 🛠️

Expanded Input Support 🔍

• Insomnia Collections: Extend your DAST capabilities to include Insomnia Collections, enabling seamless security testing for those utilizing this popular API tool.
• WP-JSON Schema: Specifically for WordPress users, we now support WP-JSON Schema, enhancing security testing for WordPress-based APIs.
• Continued Support for Existing Formats: Our DAST feature maintains its robust support for:
  • Swagger v2
  • OpenAPI v3
  • Postman Collection
  • GraphQL Introspection
  • GraphQL Schema

Why This Matters? 🌟

• Broader Testing Reach: Cover a wider range of API formats, ensuring comprehensive security coverage across different platforms and tools.
• Versatility in Security Testing: Adapt to various API design and documentation practices, offering flexibility and precision in security testing.
• Ease of Integration: Smoothly incorporate these new formats into your existing security workflows, enhancing efficiency without compromising on thoroughness.

🔐 Your Security, Our Commitment We continue to evolve our DAST capabilities to keep pace with the dynamic world of API security. Stay tuned for more updates as we constantly strive to provide top-tier security solutions.

Stay Proactive, Stay Secure!

#32 · Create New Applications in DAST Automatically via API! 🔥

Exciting news from Escape Tech! You can now create new Applications in our Dynamic Application Security Testing (DAST) service directly through the API. This update is all about enhancing your workflow efficiency and simplifying your security testing process. 🛠️

Key Features of the API Route 🗝️

• Flexible Application Settings: Define your application's specifics, like name, type (GraphQL or REST), and server URL.
• Schema Customization: Provide your application's schema as a string or through a public schema URL.
• Adaptable Scan Settings: Fine-tune your scans with settings like read/write access, customizable for safe production scans.
• Authentication Support: Add authentication details for scanning, with options for different user names and authorization headers, or opt for no authentication.
• Optional Repeater Use: Integrate a repeater if needed for your scanning requirements.

Advantages for You 🌟

• Streamlined Integration: Add new applications to DAST quickly and efficiently via API.
• Diverse API Support: Compatibility with both GraphQL and REST applications.
• Tailored Scanning Options: Customize scans for precision and safety.
• Simplified Authentication Setup: Easy setup for various authentication scenarios.

🔗 Check out the full API documentation here for detailed instructions and more info.

🔐 Elevating Your Security, Simplified Our commitment to enhancing your security processes continues. This new feature demonstrates our dedication to providing flexible and comprehensive security solutions.

Happy Secure Coding!

#26 · 🎯 Elevate Your Security Focus with Risk Contextualisation and Prioritization

Introducing a pivotal feature in Escape that transforms your security management strategy: Risk Contextualization and Prioritization. Merging the power of Escape’s distinctive Inventory and DAST features, we’re enabling AppSec Engineers to pinpoint and prioritize what genuinely requires immediate attention.

🙉 The Objective:

Ensure that your focus and remediation efforts are efficiently targeted. An SQL Injection on a route manipulating sensitive data, especially when exposed to the internet, demands priority – and we ensure you recognize such issues upfront.

🚨 Risk Categories:

Navigating through risk becomes seamless with categorization that empowers you to identify and tackle vulnerabilities adeptly.

🔎 See it in Action:

Direct your attention and resources where it truly counts by honing in on critical, sensitive, and potentially exposed endpoints that could pose significant risks.

Let’s Continue Together:

Your security journey is our priority. With features designed to streamline your risk management, we're committed to offering a platform where your security endeavors are intuitive, strategic, and impactful. Share your experiences and let’s bolster our path towards sophisticated and accessible application security!

#25 · Escape for REST APIs in General Availability

🚀 REST API Scanning Now Available in Escape

We're thrilled to announce that Escape now supports GenAI-powered DAST Scanning in CI/CD, extending our capabilities to REST APIs alongside our existing GraphQL API offerings. Implementing security practices into your CI/CD pipeline has never been so straightforward!

⚙️ What's New:

• 1. Extended API Support: Your REST APIs are now in safe hands with our advanced DAST scanning, which is now compatible with both REST and GraphQL APIs.
• 2. Diverse Input Options: Catering to a variety of workflows, Escape accepts input from OpenAPI, Swagger, or Postman, with more options en route.
• 3. Business Logic Testing: We're not just scanning - we're ensuring that your API's business logic and complex attack scenarios are thoroughly vetted.
• 4. Comprehensive Security Tests: With more than 50+ security tests now supported, we're ensuring your APIs are fortified against vulnerabilities.

For a comprehensive view of our available security tests, check out our documentation.

🚗 Taking it for a Spin:

Dive right into your API scanning and start fortifying your REST APIs alongside your GraphQL APIs. Ensuring comprehensive API security has never been this accessible or thorough.

In Closing:

As we pave the path toward robust API security, your inputs are invaluable. We're here to support your API – REST or GraphQL, and provide a secure, resilient environment for your applications. Share your feedback and let's continue this journey toward impregnable API security together!