OWASP Penetration Testing Kit - IAST (Interactive Application Security Testing)

Generate report

Scanning

Scan in runtime

Stop runtime scan

Loading

Scan progress:

Status:

All items

0

Critical

0

High

0

Medium

0

Low

0

Info

0

Execution Navigation Authz/State Data/Storage Messaging Runtime

IAST, or Interactive Application Security Testing, is a security testing method that analyzes an application while it's running, using real-time monitoring and instrumentation to identify vulnerabilities.

How to scan an application:

Click the "Scan in runtime" button and confirm it's starting
Start browsing the application you are scanning, e.g. click on different links, submit forms, etc.
Once completed open IAST scanner and stop the scan
Check the result

Rule	Module	Severity

Open Settings

Close

PTK Pro

Portal project

Upload

Download

No completed scan available to upload yet. Run or download a scan first.

Domain	Scan ID	Scan date	Download

Are you sure you want to run IAST scan against ?

Load

Reload this tab to enable runtime signals required for IAST.

Scan strategy:

Scan strategy:

Smart (recommended) keeps runtime analysis lighter, reduces startup noise, and limits expensive DOM/runtime processing.
Comprehensive runs deeper runtime tracking and broader DOM analysis, which can increase coverage, noise, and overhead.

Scan policy:

Scan policy:

Default (system) - built-in default IAST modules/rules.
PTK Pro policies can appear here when available, offering advanced and customizable scanning options for Pro users.

Cancel

Run scan

Import/Export

Export

Export

Preparing export...

Or

Import from text

Import from file