Member Avatar for Zeroday-AIAST

Interactive application security tool

  • 5 Contributors
  • 5 Replies
  • 156 Views
  • 2 Years Discussion Span
  • Latest Post Latest Post by Dani
rproffitt commented: -1 for the Dani AI content. -4
Dani commented: You don’t deserve a downvote because of Dani AI +17

Dani AI

Generated

As hinted, an IAST works at runtime and is most useful when it can instrument your actual ASP.NET process and see real requests. For ASP.NET projects pick a product that explicitly supports your runtime (classic ASP.NET on IIS and/or ASP.NET Core hosted with Kestrel/dotnet), can be installed in a test/staging environment, and integrates with your CI so findings are reproducible and triaged.

A short POC workflow to evaluate candidates:

  • Confirm vendor support for your exact .NET/runtime version and hosting model (IIS w3wp vs dotnet/Kestrel).
  • Install the agent in a non-production environment (installer, NuGet package, or profiler-based agent per vendor docs).
  • Run automated integration and functional tests that exercise authenticated flows, background jobs, and APIs.
  • Ensure debug symbols/PDBs are available so traces map to source and vulnerability evidence is useful.
  • Measure runtime overhead under representative load and verify sensitivity/tuning options.
  • Export findings to your issue tracker and test triage: check false positives and remediation guidance.

Troubleshooting and cautions: if the agent reports nothing, check that it is attached to the correct process, has required permissions, and that your tests actually hit the instrumented code paths. If traces are missing line numbers, enable PDBs and disable aggressive publish trimming. Verify telemetry redaction settings so no secrets or PII are sent. IAST complements SAST/DAST — treat it as part of a layered testing strategy and run a brief 1–2 week POC against real test traffic before committing to a vendor (common options to consider include Contrast Security, Synopsys Seeker, and Hdiv).

Recommended Answers

All 5 Replies

Member Avatar for mamta25

The best tool to keep apps safe are Contrast security and invicti. Contrast securtiy helps to find problems in real time and avoids false warning while invicti is great for checking web apps and show only real issue.

commented: Stupid necro post just to keyword spam -4
Member Avatar for rproffitt

The Dani AI content needs an OFF SWITCH. Maybe this place is trying to cater to the bots now.

commented: Then why not comment and downvote? +16
commented: Comments about Dani AI belong in the Meta forum and not hijacking someone else’s tech question -4
Member Avatar for SCBWV

I'll admit, at first I was skeptical of the value, but now I like it. It gives me more to read about the post and perhaps a different perspective. I can always scroll on passed. I'm surprised it bothers you that much. I guess an on/off switch would be nice. Perhaps too, a button to request a DaniWeb AI review if one hasn't been done for the post. Maybe the AI portion isn't visible unless the button is clicked? Several ways this can go.

Member Avatar for rproffitt

Reverend Jim commented: Then why not comment and downvote?

I thought I did.

As far as I can tell, the Dani AI is chasing Google's intent and not what people want.

At this point web masters appear to be making web sites for the new AI systems and not people!

commented: Sorry. I am currently very sleep deprived. I read your post but missed the comment. +0
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.