Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Quick start with DAST

From 6.14.0 - first download the installer:

curl -fsSL https://get.xygeni.io/latest/dast/get-dast.sh | sh   # install, signature-verified
xy-dast interactive                                            # answer a few questions
iwr -useb https://get.xygeni.io/latest/dast/get-dast.ps1 | iex
xy-dast interactive

The installer finds Docker, pulls the scanner image, verifies its signature and pins the wrapper to the digest it verified. xy-dast interactive then interviews you about the target and writes a scan profile, a command line, or both — asking only the questions that apply, and asking for the name of an environment variable rather than for any password or token.

Later, xy-dast update pulls, verifies and re-pins to the newest image, keeping the wrapper and the image in step.

The rest of this page is the manual route, which works with any released image and in environments the installer cannot reach from.

Requirements

  • Docker Engine 20.10+ (or Docker Desktop) with Compose v2 — i.e. the docker compose ... subcommand. The legacy docker-compose v1 binary is not supported, and Podman is not a substitute: the wrapper drives docker compose, which Podman does not provide.

  • A directory on your PATH to drop the wrapper into. This guide uses ~/.local/bin (Linux/macOS) and %USERPROFILE%\.local\bin (Windows).

  • The XYGENI_TOKEN environment variable must exist and contain a valid token.

Step 1 — Create the install directory and ensure it is on your PATH

This is the most common source of "command not found: xy-dast" issues. The install directory must exist before the install command (Docker creates it as root if it does not, which then fails to write), and it must be on your PATH for the short xy-dast command to work.

# 1. Create the directory (idempotent)
mkdir -p ~/.local/bin

# 2. Make sure it is on PATH for the current shell
case ":$PATH:" in *":$HOME/.local/bin:"*) ;; *) export PATH="$HOME/.local/bin:$PATH" ;; esac

# 3. Persist for future shells (only needed once per shell rc)
grep -q '\.local/bin' ~/.bashrc 2>/dev/null \
  || echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
# zsh users: replace ~/.bashrc with ~/.zshrc

Verify:

echo "$PATH" | tr ':' '\n' | grep -F "$HOME/.local/bin"   # should print the path
# 1. Create the directory
mkdir -p ~/.local/bin

# 2. Add to PATH for the current shell
export PATH="$HOME/.local/bin:$PATH"

# 3. Persist for future shells (zsh is the default since macOS Catalina)
grep -q '\.local/bin' ~/.zshrc 2>/dev/null \
  || echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
# bash users: replace ~/.zshrc with ~/.bash_profile

Verify:

echo "$PATH" | tr ':' '\n' | grep -F "$HOME/.local/bin"

Verify (open a new PowerShell window after persisting):

The Windows wrapper is a PowerShell script (xy-dast.ps1) signed with an Authenticode certificate. If your execution policy blocks running scripts, run Set-ExecutionPolicy -Scope CurrentUser RemoteSigned once.

Step 2 — Install the wrapper from the Docker image

The image's install subcommand drops two files into the mounted directory: the xy-dast wrapper script itself and a sidecar xy-dast-compose.yml that holds the image reference, environment forwarding, and runtime parameters.

--powershell produces the signed .ps1 wrapper (and matching sidecar) instead of the bash one.

Verify:

If you get command not found (or not recognized as ... cmdlet), revisit Step 1 — the directory is almost certainly not on your PATH yet.

Step 3 — Launch a web application

For the purposes of this guide, Juice Shop can be substituted with any web application you would like to test.

Quick Start

Scan a web application:

Results are uploaded to the Xygeni platform by default. To save a local report instead, use -o:

If you have launched juice shop as mentioned on Step 3, you can use:

For more information about the DAST scanner please see: DAST Scanner.

PreviousQuick start with the CLI
NextLog in to Xygeni

Last updated