Comparing Open-Source DAST Tools — Binding ZAP, Nuclei, Wapiti, and Nikto into a DevSecOps Pipeline

DAST (dynamic application security testing) hits a running app from the outside with simulated attacks to surface runtime-specific vulnerabilities that SAST and SCA miss. Open-source DAST has moved from 'one tool does everything' to 'divide the work among lightweight tools.' Centered on the all-around ZAP, template-driven Nuclei, lightweight-CLI Wapiti, and server-exposure-focused Nikto, this article adds the SQLi specialist sqlmap and the XSS specialist Dalfox, plus the free-but-not-OSS Dastardly and StackHawk, and lays out 2026 selection criteria alongside SPA/API coverage, phased CI/CD integration, and false-positive tuning.