DAST
Every OWASP test.
Signed in, every role.
An agent signed in as every role works through the complete OWASP Web Security Testing Guide against every function it finds, on top of crawling, active scanning and known vulnerability checks.
Coverage ledger
OWASP WSTG v4.2 · every test
| Category | Tested | Not applicable | Blocked |
|---|---|---|---|
| Information gathering | 10 | 0 | 0 |
| Configuration | 9 | 2 | 0 |
| Identity | 4 | 1 | 0 |
| Authentication | 9 | 1 | 0 |
| Authorisation | 4 | 0 | 0 |
| Sessions | 8 | 1 | 0 |
| and 6 more categories · 81 tested · 16 not applicable · 1 blocked | |||
Blocked: file upload needs a test account with upload rights
What it does
- The full OWASP methodEvery test in the OWASP WSTG v4.2, across all 12 categories from information gathering to business logic.
- APIs as well as pagesOpenAPI, Swagger, Postman and HAR files become the work list, GraphQL included.
- Signed in, as every rolePaste a session, give credentials or record a sign-in with MFA. Test several roles in one scan.
- A ledger, not a guessEvery test is marked tested, not applicable or blocked, with a reason. A gap makes the scan incomplete.
- Proof you can replayEach finding carries its evidence and a curl command that reproduces it.
- Your scope, enforcedThe submitted host is the boundary. Assessment mode never exploits.
What you get
- A coverage figure such as 57 of 57 applicable cases
- Findings with request, response and curl reproduction
- Mapping to the OWASP Top 10 and API Security Top 10
- A report naming the method and its limits
Mapped to
- OWASP WSTG 4.2
- OWASP Top 10 2025
- OWASP API Top 10 2023
- CVSS 3.1
How it works
- Give it a targetA web address or an API collection, and how to sign in.
- Choose the depthScanner only, or Scanner + Agent. Set crawl depth and request rate.
- Read the ledgerCoverage as one figure, every finding with proof, every gap with a reason.
Documentation
Read the details
Setup, every option and the API, on docs.cerberon.dev.
Common questions
Can it test pages behind a login with MFA?
Yes. Record the sign-in in a browser, including MFA or a CAPTCHA. The session is held on your server.
Will a scan exploit my application?
Only in penetration test mode. Assessment mode verifies without exploiting and runs no denial of service or brute force.
See it on your own systems.
A 30-minute demo on your targets, or install it yourself and start scanning this afternoon.