nightvision-dast

Overview

Per docs.nightvision.net:

"NightVision is a white-box-assisted Dynamic Application Security Testing (DAST) tool" that "helps you identify security vulnerabilities in web applications and REST APIs."

It "analyzes code before simulating attacks and traces findings back to their origin" per nv-docs - the source-traceability that sets it apart from black-box tools (ZAP / Burp).

When to use

• The team needs source-traceable DAST (findings link to specific code locations, not just URLs).
• API-heavy repo with OpenAPI / Swagger / GraphQL specs available as the scan target.
• Team wants spec-driven coverage (NightVision derives request surface from API specs vs crawling).
• Layered with zap-baseline for combined coverage.

How to use

1. Install the nightvision CLI and authenticate (nightvision login).
2. Pick the target: prefer an OpenAPI / Postman / GraphQL spec over a crawl URL so the scanner knows the full request surface (see Target types).
3. Create and run a scan against staging with the right auth mode, wait for it to finish, and pull findings (see Worked example).
4. Triage findings, suppress false positives via Alert Rules with a re-review date (see False-positive triage), then wire the scan into CI as a SARIF gate - full workflow and scope tuning in references/ci-and-scan-operations.md.

Install

Per nv-docs, "Installing the CLI":

# Linux/macOS
curl -fsSL https://install.nightvision.net | sh

# Verify
nightvision --version

# Authenticate
nightvision login

Target types

Per nv-docs the platform supports:

Authentication

Per nv-docs the platform supports:

For interactive logins, the auth recorder captures the login flow in the dashboard UI; the recording is saved and referenced by name in subsequent scans.

Worked example

Scan an OpenAPI-described API on staging with a bearer token, wait for the run to finish, then export findings as JSON for triage and SARIF for GitHub Code Scanning:

# Create a spec-driven scan with header auth
SCAN_ID=$(nightvision scan create \
  --name "my-api-staging" \
  --target-url https://staging.example.com \
  --spec ./openapi.yaml \
  --auth header \
  --auth-header "Authorization: Bearer $TOKEN" \
  --output json | jq -r '.id')

# Block until the scan finishes
nightvision scan get "$SCAN_ID" --wait

# Export findings: json for cross-tool triage, sarif for Code Scanning
nightvision scan results "$SCAN_ID" --output json > findings.json
nightvision scan results "$SCAN_ID" --output sarif > nightvision.sarif

Verify: the run must reach a completed state before you export. If --wait returns a failed or timed-out run, the auth mode or scope is wrong - fix --auth-header (or the scope) and re-run the scan before triaging.

False-positive triage (MANDATORY)

Per nv-docs "Alert Rules" govern per-finding suppression:

Justification template (mandatory in Alert Rules):

Alert Rule: Suppress "SQL Injection" on /search?q=
Reason: parameter pre-validated via Joi schema; verified safe in code review
Reviewer: alice@example.com (2026-05-15)
Expires: 2026-12-15
Re-review-date: 2026-12-15

Cadence: every quarter, audit Alert Rules in the dashboard; expired rules removed; persistent ones reviewed.

Operating in CI

Run the scan against staging on push, export --output sarif, and upload it via github/codeql-action/upload-sarif so findings land inline on the PR. Pin a CLI version in CI, and tighten scope control first so scans stay focused and within budget. The full GitHub Actions workflow, the scope-control patterns, and the output-format matrix live in references/ci-and-scan-operations.md.

Anti-patterns

Limitations

• Commercial product - pricing model varies; check nightvision.net for current.
• White-box-assistance requires source-code awareness - most useful for codebases NightVision can analyze (consult docs for language coverage).
• For pure black-box DAST without commercial cost, use zap-baseline + burp-headless combination instead.
• Per nv-docs CLI / API / dashboard surface evolves; pin a CLI version in CI.
• TOTP auth is supported but configuration is fragile when MFA policy changes.

References

• nv-docs - official documentation
• nightvision.net - product page
• zap-baseline, burp-headless - sister DAST tools
• dast-scan-cadence-author - build-an-X for layered DAST
• CI wiring, scope control, and output formats (with their own citations): references/ci-and-scan-operations.md