Acunetix Integration with DefectDojo

Acunetix Integration with DefectDojo

Acunetix is a dynamic application security testing (DAST) scanner from Invicti Security. It crawls web applications and APIs and tests them for issues such as injection flaws, cross-site scripting, misconfigurations, and outdated server software. Acunetix is available as an on-premises scanner and as Acunetix 360, a hosted platform at online.acunetix360.com. DefectDojo reads the on-premises XML export and the Acunetix 360 JSON export with one scan type, and DefectDojo Pro adds a connector for Acunetix 360.

Acunetix Integration with DefectDojo

We use Acunetix to test what is actually deployed, and DefectDojo is where those results get handled. A finished Acunetix scan tells you what is wrong with a site today. Imported into DefectDojo, every issue becomes a Finding on the Asset that owns the site, with the affected URLs attached as endpoints, an SLA based on severity, and an owner. When the next scan runs, the reimport shows what got fixed and what is new, which is the question our application teams actually ask.

Why Acunetix Matters

Static analysis tells you what the code might do. A DAST scanner like Acunetix tells you what the running application does when someone sends it hostile input.

• It finds issues that only exist at runtime, such as server misconfigurations, missing security headers, and vulnerable framework versions exposed by the deployed stack.
• Findings come with the affected URL and, in many cases, the HTTP request that triggered them, which makes reproduction straightforward.
• Each issue includes impact, remediation guidance, CWE classification, and often a CVSS vector.
• Scanning a large web estate produces a lot of output. Without a tracking platform, repeat scans recreate the same list and nobody can tell what changed.

Advantages of This Integration

What we gained by sending Acunetix results through DefectDojo:

• Consolidation of repeated issues. Both parsers group occurrences of the same issue into a single Finding with every affected URL attached as an endpoint, so one missing header across 200 pages is one Finding.
• Deduplication across scans. DefectDojo hashes Acunetix Scan findings on title and description, so rescanning a site matches existing findings instead of duplicating them.
• Vendor triage carried over. In Acunetix 360 JSON, issues marked AcceptedRisk arrive as risk-accepted and issues marked FalsePositive arrive as false positives, both inactive.
• Lifecycle tracking. Reimporting into the same Test mitigates issues that no longer appear and reactivates any that return.
• DAST next to everything else. Acunetix findings sit on the same Asset as SAST and SCA results, so one report and one set of SLAs cover the application.

How This Integration Works

DefectDojo imports both report formats with the Acunetix Scan scan type. The parser chooses the format by file extension: files ending in .xml go to the Acunetix XML parser and files ending in .json go to the Acunetix 360 parser. Keep those extensions when you save exports.

1. Export the results. From the on-premises scanner, export the scan as XML. The parser expects a ScanGroup document containing Scan elements with ReportItems. From Acunetix 360, export the scan's vulnerabilities as JSON; the parser expects top-level Generated, Target, and Vulnerabilities keys.

2. Import the file. In the UI, open the Engagement, choose Import Scan Results, select Acunetix Scan, and upload the file. To automate it, use the import API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Acunetix Scan" \
  -F "file=@acunetix-storefront.xml" \
  -F "product_name=storefront" \
  -F "engagement_name=DAST" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Acunetix Scan" \
  --report-path "./acunetix-storefront.xml" \
  --product-name "storefront" \
  --engagement-name "DAST" \
  --auto-create-context

3. Or connect Acunetix 360 directly (DefectDojo Pro). The Acunetix 360 connector authenticates with an API User ID and API Token from Acunetix 360's API Settings. Enter https://online.acunetix360.com as the Location, add the credentials, and optionally set a Minimum Severity. DefectDojo creates a Record for each scanned website and imports findings from that website's latest completed scan. Issues marked Accepted Risk or False Positive in Acunetix 360 are imported but flagged inactive. The connector covers Acunetix 360 only, not the on-premises scanner, which has a different API.

Data Granularity: What Gets Imported

Within one report, the XML parser merges items that share title, impact, and recommendation, adding their endpoints, details, and requests to one Finding and counting occurrences. The JSON parser merges by title alone.

Use Cases

For scheduled scans of production sites: A weekly Acunetix scan of each public site is reimported into a stable Test. The application owner reviews the delta, and new High and Critical findings go straight to Jira.

When an Acunetix 360 subscription covers many sites: DefectDojo Pro teams use the connector so each website arrives as a Record that maps to an Asset, without anyone exporting files by hand.

Before a major release: A staging scan imported into a release Engagement gives the release manager a list of open DAST findings with severities and owners, which is easier to sign off on than a PDF report.

For audit evidence: PCI-DSS and similar reviews ask for proof that web vulnerabilities were found and fixed. DefectDojo keeps discovery dates, SLA status, and closure dates for each Acunetix finding.

Operational Tips

• Keep the .xml or .json extension on exports. The parser relies on it to pick the right format.
• Check XML severities. Anything that isn't high, medium, low, or informational is imported as Critical, so confirm your export's values before SLAs start counting.
• In the XML parser, any non-empty IsFalsePositive value marks the finding as a false positive. Review a sample import if your exports populate that element.
• Use one Test per site and reimport into it, so findings for fixed URLs are mitigated automatically.
• Tag imports with environment and site (for example tags=prod,storefront) to separate staging and production results.
• If you triage in Acunetix 360 first, its AcceptedRisk and FalsePositive states carry over, so you won't repeat that work in DefectDojo.