Last updated: February 10, 2023
Read time: 1 Minute
Dastardly cannot navigate login mechanisms. If your application uses authentication, you should consider disabling this functionality when scanning with Dastardly. If you want to scan authenticated areas of an application while authentication functionality is in place, you can use either Burp Suite Enterprise Edition or Burp Suite Professional to do this.
Dastardly is deployed inside a Docker container, and uses a Chromium-based browser to scan your target application. To allow this, Dastardly's browser sandbox is disabled.
Because Dastardly is designed for scanning only trusted internal applications, its browser sandbox should not be necessary.
Dastardly attempts to parse any OpenAPI v3.x.x specification JSON-based API definitions it encounters, and scans these definitions for vulnerabilities. If the target application makes an API call to an endpoint that is on the same domain as the seed URL, then this API call is scanned by Dastardly. If the target application makes an API call to an endpoint that is not on the same domain as the seed URL, then this API call is not scanned, as it is considered to be out of scope.
Was this article helpful?
An error occurred, please try again.