Black Duck Web Scanner

Black Duck Web Scanner (formerly Synopsys Web Scanner) is an enterprise DAST tool that runs on the Polaris Software Integrity Platform. It tests running web applications and APIs for security vulnerabilities using a headless browser engine and proof-based verification.

The scanner is part of Black Duck’s larger security portfolio, which includes Coverity (SAST), Black Duck SCA, and Seeker (IAST). Over 4,000 organizations use Black Duck products. The company has held Gartner Magic Quadrant Leader status for 8 consecutive years as of 2025.

Synopsys divested its Software Integrity Group to Clearlake Capital and Francisco Partners in 2024. The products now operate under the Black Duck Software brand.

What is Black Duck Web Scanner?

Black Duck Web Scanner performs automated security testing against live or staging web applications. It crawls applications using a headless browser that executes JavaScript, handles SPAs, and intercepts AJAX calls. Then it fires attack payloads and checks responses for vulnerabilities.

What sets it apart from many DAST tools is proof-based verification. When the scanner finds a potential flaw, it attempts to confirm the vulnerability is real and exploitable. This cuts down false positives and gives development teams concrete evidence of the issue.

The scanner plugs into the Polaris platform alongside Coverity (SAST) and Black Duck SCA. Findings from all three testing methods appear in a single dashboard, letting security teams see whether a code-level flaw identified by SAST is also exploitable at runtime.

Key Features

Vulnerability Coverage

The scanner tests for the standard set of web application vulnerabilities:

• SQL Injection: Error-based, blind, and time-based
• Cross-Site Scripting: Reflected, stored, and DOM-based XSS
• XXE: XML External Entity injection
• SSRF: Server-Side Request Forgery
• Insecure Deserialization: Object injection attacks
• Security Misconfiguration: Headers, exposed files, default credentials
• Sensitive Data Exposure: Unencrypted data, leaked tokens

API Security Testing

REST API endpoint discovery and testing, GraphQL query analysis, and OpenAPI/Swagger specification import. The scanner also tests API authentication mechanisms and access control.

Policy Enforcement

Organizations define security policies that span testing types. For example, you can require no high-severity DAST findings before production deployment while allowing medium-severity issues with mitigation plans.

Integrations

CI/CD Platforms

GitHub Actions

GitLab CI

Azure DevOps

Jenkins

Black Duck Ecosystem

Coverity SAST

Black Duck SCA

Seeker IAST

Software Risk Manager

Getting Started

CI/CD Integration

GitHub Actions

name: Black Duck DAST Scan
on:
  push:
    branches: [main]

jobs:
  dast-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Black Duck Web Scanner
        uses: blackducksoftware/polaris-action@v1
        with:
          polaris-url: ${{ secrets.POLARIS_URL }}
          polaris-token: ${{ secrets.POLARIS_TOKEN }}
          scan-type: dast
          target-url: ${{ vars.STAGING_URL }}

      - name: Check for Critical Findings
        run: |
          polaris-cli findings \
            --project-name ${{ github.repository }} \
            --severity critical,high \
            --fail-on-findings

When to Use Black Duck Web Scanner

Black Duck Web Scanner fits enterprise teams that want DAST integrated with their SAST and SCA tools on a single platform. The proof-based verification is genuinely useful for reducing false positive noise.

Good fit for:

• Organizations already using Coverity or Black Duck SCA that want correlated findings
• Enterprise teams managing large application portfolios with centralized policy enforcement
• Compliance-driven environments needing audit-ready reports
• Teams testing JavaScript-heavy SPAs and modern web frameworks

Not the best fit if:

• You want a free or open-source scanner — try ZAP instead
• You need a standalone DAST tool without a platform — simpler single-purpose tools exist
• You’re a small team scanning a few applications — the enterprise platform adds overhead you may not need

Frequently Asked Questions