I am looking for DAST software to test a Flask (Python) web service. An important point is how to integrate it in the workflow: Either it needs to be part of a CI/CD pipeline or it needs to run continuously and have a slack integration to warn about new issues. It's important that the issues can be managed (e.g. marked as fixed / false-positive, prioritized).
What I've seen
- Tinfoil / misterscanner.com as a commercial solution, but I would like to see what gratis solutions can do.
- arachni-scanner (Github), but it is no longer maintained. It seems to be running continously and has a nice issue management directly included. I'm uncertain if there are Slack integrations.
- Nikto (Github). It does not have DAST in the description, but it seems to be a tool in this category (source). It seems to be only a CLI program. No issue management, no integrations.
- w3af (Github): I couldn't get it to run on Ubuntu (issue)
- OWASP ZAP has a GUI, but I'm uncertain how to track / manage issues in a team. Also, I'm not certain how to include it in a workflow.