Rapid7 InsightAppSec

What is Rapid7 InsightAppSec?

Rapid7 InsightAppSec is a Dynamic Application Security Testing (DAST) solution that automatically scans web applications and APIs for vulnerabilities.

Key differentiators:

• Intelligent Crawling - automatic application discovery
• Attack Replay - attack replay for developers
• CI/CD native - pipeline integration
• API testing - REST and SOAP API testing

How DAST Works

graph LR
    subgraph "InsightAppSec"
        A[Crawl Engine] --> B[Attack Engine]
        B --> C[Vulnerability Analysis]
        C --> D[Report & Replay]
    end

    subgraph "Target"
        E[Web Application]
        F[REST API]
        G[Authentication]
    end

    A --> E
    A --> F
    B --> E
    B --> F
    G --> A

Scanning Features

Crawl Engine

• Intelligent crawling - all endpoint discovery
• JavaScript parsing - SPA support (React, Angular, Vue)
• Form detection - automatic form filling
• Authentication - various authentication method support

Attack Engine

Vulnerability testing:

Category	Examples
Injection	SQL, NoSQL, LDAP, XPath, Command
XSS	Reflected, Stored, DOM-based
Authentication	Brute force, session management
CSRF	Cross-Site Request Forgery
XXE	XML External Entity
SSRF	Server-Side Request Forgery
File Upload	Malicious file upload
Business Logic	Logic flaws, authorization bypass

OWASP Coverage

Full OWASP Top 10 coverage:

• A01: Broken Access Control
• A02: Cryptographic Failures
• A03: Injection
• A04: Insecure Design
• A05: Security Misconfiguration
• A06: Vulnerable Components
• A07: Authentication Failures
• A08: Data Integrity Failures
• A09: Logging Failures
• A10: SSRF

API Security Testing

Supported API Types

• REST API
• SOAP Web Services
• GraphQL
• gRPC

API Discovery

• OpenAPI/Swagger import
• Postman collection import
• HAR file import
• Manual endpoint definition

API-specific Tests

• Authentication bypass
• Authorization flaws
• Rate limiting
• Input validation
• Data exposure

Attack Replay

Unique feature for developer collaboration:

[Vulnerability Found] --> [Attack Replay Generated] --> [Developer Reproduces] --> [Fix Verified]

Attack Replay Benefits:

• Developer sees exactly how to execute the attack
• Easier vulnerability understanding
• Faster remediation
• Fix verification

CI/CD Integration

Pipeline automation:

Supported Platforms

• Jenkins
• GitLab CI
• GitHub Actions
• Azure DevOps
• CircleCI
• Bamboo

Scan Policies

• Full scan - complete scanning
• Incremental scan - changes only
• Quick scan - quick critical check
• Custom policy - custom rules

Quality Gates

# Example configuration
fail_on:
  - severity: HIGH
    count: 0
  - severity: MEDIUM
    count: 5

Scan Configuration

Authentication Options

• Form-based login
• OAuth 2.0
• SAML
• API keys
• Custom headers
• Certificate-based

Scan Optimization

• Excluded paths
• Rate limiting
• Scan windows
• Parallel scanning

Reporting

Report Types

• Executive summary
• Technical details
• Compliance (OWASP, PCI DSS)
• Trend analysis
• Remediation guidance

Export Formats

• PDF
• HTML
• CSV
• JSON (for integrations)

Integrations

Issue Tracking

• Jira
• GitHub Issues
• Azure Boards
• ServiceNow

Developer Tools

• IDE plugins
• Slack notifications
• Email alerts
• Webhooks

Who is it for?

Rapid7 InsightAppSec is for organizations that:

• Develop web applications and APIs
• Need DAST in CI/CD
• Require compliance (OWASP, PCI DSS)
• Want Security-Dev collaboration

Comparison with Competition

Feature	InsightAppSec	Burp Suite	OWASP ZAP
Cloud-native	✅	❌	❌
Attack Replay	✅	❌	❌
API Testing	✅	✅	✅
CI/CD Integration	✅	✅	✅
Enterprise support	✅	✅	Community

Deployment with nFlo

1. Application Inventory - application list for scanning
2. Scan Engine Setup - scan engine installation
3. Authentication Config - login configuration
4. Baseline Scan - first scan
5. CI/CD Integration - pipeline integration
6. Policy Tuning - policy tuning
7. Training - AppSec team training