https://github.com/akha-security/akca

What it is

AKCA (github.com/akha-security/akca) is a Go CLI DAST scanner, currently at v0.2.5, installed via go install github.com/akha-security/akca/engine/cmd/akca@latest (requires Go 1.25+) or downloaded from GitHub Releases with SHA256SUMS.txt and gh attestation verify provenance checks.

How it works

Execution is a staged pipeline: fingerprint/calibrate (tech, WAF, TLS, pacing) → discover attack surface (HTTP + persistent headless-browser crawl, JS/AST analysis, API specs, path fuzzing, 403-bypass probing) → model test candidates by method/content-type/param/auth context → plan adaptive probes prioritized by relevance → verify signals (baselines, negative controls, identity/state comparisons, OAST callbacks) → produce Burp-style evidence exports. Coverage gaps (budget cutoffs, skipped checks) are explicitly recorded rather than treated as clean results, and interrupted scans are not auto-resumed. Browser crawling can learn up to 32 passive third-party dependency hosts from resource tags/CSP automatically, but only allows GET/HEAD static-asset requests to them and never expands active scan scope that way.

Preconditions / Affected

Browser-backed checks require Chrome, Chromium, or Edge installed locally. Some authorization checks (BFLA, multi-tenant isolation) need multiple configured identities, not just one session. Rate-limit findings require both a configured threshold and a window_seconds value, otherwise results are "observations" not findings, and a mismatched window makes the check inconclusive. SQLi findings explicitly never rely on a bare 400 response or arithmetic-evaluation alone as proof.

What to do

Basic scan:

akca -u https://example.com

Targeted modules with HTML report:

akca -u https://example.com -m sql,xss,rce -f html -o report.html

API spec import:

akca -u https://api.example.com --api-spec ./openapi.yaml -m api

Bound resource use:

akca -u https://example.com --request-budget 5000 --time-budget 30m

or

akca -u https://example.com --requests-per-target 200

(--request-budget takes precedence over --requests-per-target; default crawl cap is 1,500 requests / 1,000 pages, module scanning itself is unbounded). Replay a stored finding for verification: akca replay --finding 42. By default reports mask recognized credentials; set redact_reports to false only when raw evidence is needed. Build-from-source verification before trusting a build:

go test ./... -count=1
go vet ./...
go run ./cmd/akca benchmark --strict
go run ./cmd/akca benchmark --complete-corpus

Caveats

Single-developer project, explicitly not claiming parity with Acunetix/Invicti/Burp Pro. Roadmap items not yet shipped include distinguishing browser-confirmed reflected XSS from true DOM-based execution, heuristic IDOR coverage for single-profile scans, and broader cloud-takeover fingerprinting — current detection in these areas should be treated as partial. Linked API/service subdomains are excluded from scope by default (--include-linked-api-subdomains required to include them).