skills.rest
harness
harnessOFFICIAL
Explore all skills by this author →
WebsiteGitHub

configure-dast-scan

Configure DAST scans in Harness pipelines with supported scanners.

80|16|Updated Mar 11, 2026
Search Tags:#pipeline#nmap#zap#security-testing#dast#burp#traceable
One-click install
npx skills add https://github.com/harness/harness-skills --skill configure-dast-scan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: configure-dast-scan
Source: https://github.com/harness/harness-skills/tree/main/skills/configure-dast-scan
Command: npx skills add https://github.com/harness/harness-skills --skill configure-dast-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Add Dynamic Application Security Testing (DAST) steps to existing Harness pipelines using Harness STO scanners. Supports API DAST / Traceable (default), Burp Suite Enterprise, ZAP (OWASP), Nikto, and Nmap. Scans running application instances for vulnerabilities including API security issues, injection flaws, misconfigurations, and exposed services. Can insert the scan step into an existing CI or SecurityTests stage or create a dedicated SecurityTests stage. Use when asked to add DAST scanning, configure dynamic application testing, set up API security scanning, scan a running application, or add runtime security testing to a pipeline. Trigger phrases: add DAST scan, dynamic application security testing, API DAST, configure Traceable, scan running app, add Burp Suite scan, add ZAP scan, add Nikto scan, runtime security scan, API security scan.

Core Features & Use Cases

  • Insert DAST steps into existing SecurityTests stage or CI, or create a dedicated SecurityTests stage for runtime security testing.
  • Supports API DAST (Traceable), Burp Suite Enterprise, ZAP, Nikto, and Nmap scanners, with guidance on mode selection and authentication.
  • Works with running application instances; requires after-deployment execution and optional infrastructure choices (Harness Cloud or KubernetesDirect).

Quick Start

Provide the Traceable domain, scan ID, and a token secret to configure an API DAST scan in your existing pipeline.

Frequently Asked Questions about configure-dast-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add a DAST scan to an existing Harness pipeline?▼

To add a DAST scan to a Harness pipeline, you can insert a step into an existing CI or SecurityTests stage, or create a dedicated SecurityTests stage to run dynamic application security testing against your deployed application.

Can I use OWASP ZAP or Burp Suite Enterprise for dynamic application security testing in Harness?▼

Yes, dynamic application security testing in Harness supports OWASP ZAP, Burp Suite Enterprise, Nikto, Nmap, and Traceable for API DAST to scan running application instances and identify vulnerabilities like injection flaws and misconfigurations.

What do I need to configure an API DAST scan with Traceable in my pipeline?▼

To configure an API DAST scan with Traceable, you need to provide the Traceable domain, a scan ID, and a token secret to authenticate and execute the runtime security scan within your pipeline.

Does a DAST scan require a running application instance before execution?▼

Yes, DAST scans require a running application instance because they perform runtime security testing after deployment. You can execute these scans using infrastructure options like Harness Cloud or KubernetesDirect.

How does Harness handle scanner authentication and mode selection for DAST?▼

Harness handles DAST scanner authentication and mode selection by offering orchestration, extraction, and ingestion modes, providing guidance on scanner authentication, and protecting against misconfigurations during setup.

Related Skills

Explore More Software Engineering Skills→
harnessharness
80

configure-repo-scan

Insert code scanning steps into existing Harness pipeline YAML.

Official
Intermediate
thisrohanguptathisrohangupta
1

security-report

Generate security compliance reports from Harness SCS and STO vulnerability data.

Community
Advanced
Logos-LiberLogos-Liber
17

vulnerability-scanning

Identifies security vulnerabilities in code, dependencies, and container images.

Official
Advanced
amano--amano--

burp-suite

Intercept HTTP traffic and test web applications for security vulnerabilities.

Community
Advanced