Dynamic Application Security Testing (DAST)
Dynamic application security testing (DAST) tests an application while it is running. It simulates attacks against the application, usually from the outside, and analyzes how the application reacts to determine whether it is vulnerable.
Updated
Overview
DAST tools are automated scanners that test web applications, normally from the outside, for security vulnerabilities such as cross-site scripting, SQL injection, command injection, path traversal, and insecure server configuration. They target web-enabled applications, services, and APIs during testing or operational phases.
DAST is black-box testing. The tools scan the client side and the server side without needing the source code or the framework the application is built on. They are especially helpful for detecting input and output validation flaws, authentication issues, and server configuration mistakes. Once configured, they usually need little user interaction and can run as part of a nightly scan.
In a CI/CD pipeline, DAST tools can spin up a copy of the production environment inside the CI job and scan the resulting containers and executables. Because the application is running, this catches dependencies loaded at launch time that static analysis would not catch.
Similar Terms
2 termsSAST
DAST tests the running application from the outside, without its source code. SAST analyzes the source, bytecode, or binary code without running it, typically during programming and testing.
Penetration Testing
DAST tools are automated scanners that usually need little user interaction once configured. A penetration test cannot be entirely procedural, so its quality depends closely on the abilities of the testers involved.
Frequently Asked Questions
What does DAST stand for?→
DAST stands for dynamic application security testing. Web application vulnerability scanners are frequently referred to as DAST tools.
What is the difference between DAST and SAST?→
DAST analyzes an application in its running state by simulating attacks and analyzing the reactions. SAST analyzes the application's source, bytecode, or binary code. Because the application is running, DAST can catch dependencies loaded at launch time that SAST would not catch.
Does DAST need access to source code?→
No. DAST is black-box testing: the tools scan the client side and the server side of a running application without needing its source code or the framework it is built on.
What vulnerabilities does DAST find?→
DAST tools look for vulnerabilities such as cross-site scripting, SQL injection, command injection, path traversal, and insecure server configuration. They are especially helpful for detecting input and output validation flaws, authentication issues, and server configuration mistakes.
Related
Tool categories
Career roles
Glossary terms
Sources
Definitions follow the government and standards body sources listed above. This site is not affiliated with the agencies or organizations cited.