av dast scan

Scan a running web application or API and tier every finding REDYELLOWGREEN.

Synopsis

av dast scan --target <url> [flags]

The binary ships as alertavuln; av is the common alias - they are interchangeable in every example.

Authorization required

A DAST scan sends live requests to the target you name - and, with --active, real attack payloads. Only scan systems you own or are explicitly authorized to test. Unauthorized scanning may be illegal (for example under the US CFAA or the UK Computer Misuse Act) and is your sole responsibility.

Every av dast scan prints this disclaimer and then requires authorization before any engine runs. Attest it up front with --i-am-authorized, or answer the interactive [y/N] prompt. In a non-interactive context (CI, no TTY) the scan is refused unless --i-am-authorized is passed. Running --active against a --environment production target additionally requires --i-am-authorized, and fails fast without it.

Description

av dast scan runs the bundled scanners against a running target URL, and normalises everything they emit into a single finding set rendered as a table (or JSON with --json).

Scans are passive by default: the scanners crawl the target and observe its responses without sending attack traffic, so a passive scan is non-intrusive and safe to run anywhere, including production. Add --active to also run attack-payload rules; --intensity tunes how aggressive an active run is (request rate, concurrency, and time budget). --active is gated for production - see the authorization note above.

Pass --project to upload the findings to that project so they appear on its Dynamic Scan page. The target’s git ref is detected from the working tree’s git metadata and recorded as provenance. --no-upload keeps a scan local-only even when --project is set. The --target value must be an absolute http(s) URL; any credentials embedded in it are stripped before the URL reaches the engines, the upload, or any log.

For CI gating, --fail-on makes the command exit non-zero when the worst finding is at or above the given tier.

Options

Flag	Default	Description
--target	-	Target base URL to scan (required; absolute http(s) URL)
--project	-	Project ID to upload findings to (omit for a local-only scan)
--json	false	Output the scan as JSON instead of a table
--export	-	Export to a directory or file (HTML; raw JSON with --json)
--no-upload	false	Scan locally only; do not upload even if --project is set
--fail-on	none	Exit non-zero if the worst finding is at or above the tier: red, yellow, or none
--active	false	Run active (attack-payload) rules in addition to the passive checks
--intensity	low	Scan intensity (rate, concurrency, time budget): low, medium, or high
--environment	staging	Target environment: staging, production, or internal (gates --active)
--i-am-authorized	false	Attest you own or are authorized to test the target (required non-interactively; also gates --active against production)

Examples

Passive scan of a running staging site (you confirm authorization at the prompt):

av dast scan --target https://staging.example.com

Scan and upload the findings to a project’s Dynamic Scan page:

av dast scan --target https://staging.example.com --project <projectId>

Gate a CI pipeline - non-interactive, so authorization is attested with the flag, and the run exits non-zero on a RED finding:

av dast scan --target https://staging.example.com \
  --i-am-authorized --fail-on red --json

Run an active scan (attack payloads) against a non-production target at higher intensity:

av dast scan --target https://staging.example.com \
  --active --intensity high --i-am-authorized

Active scan of a production target - permitted only with the explicit attestation:

av dast scan --target https://app.example.com \
  --environment production --active --i-am-authorized

Note

The scanners are auto-downloaded - pinned and checksum-verified - on first use, and run locally as separate processes. The CLI reports their generic capability labels (web-scanner, template-scanner) rather than product names. A scanner that can’t run in your environment is skipped with a notice and the rest of the scan still runs. Only when you pass --project are the resulting findings - never your traffic or credentials - uploaded.

Exit codes

Code	Meaning
0	Scan completed and no finding is at or above the --fail-on tier
1	Scan failed, authorization was refused or declined, or at least one finding is at or above the --fail-on tier

See also

• av dast findings - pull the consolidated DAST findings the server holds for a project
• av dast targets - list a project’s registered scan targets
• av dast jobs - show a project’s DAST scan-run history
• Dynamic scanning (DAST) - what DAST covers, passive vs active, and hosted vs self-hosted