Dynamic Application Security Testing (DAST)
Security testing that attacks the running application from the outside — catching the runtime and config flaws static analysis can't see, at the cost of coverage and speed.
What is DAST?
Dynamic Application Security Testing probes a running application the way an attacker would — sending malicious requests, fuzzing inputs, following links, and observing responses to find exploitable flaws. Unlike SAST, which reads source code, DAST is black-box: it needs no source, tests the deployed system as it actually behaves, and therefore catches an entirely different class of problem — runtime misconfigurations, TLS/header issues, authentication flaws, and injection that only manifests against the live stack.
What DAST sees that SAST can’t (and vice versa)
The two are complementary, not competing. SAST finds insecure code but drowns in false positives and can’t see runtime reality. DAST finds insecure behavior — a misconfigured server, a missing security header, an auth bypass, an injection that depends on the actual database — with far fewer false positives (it demonstrated the flaw), but it misses code paths it never reaches, can’t pinpoint the vulnerable line, and needs a running, reachable environment. Serious programs run both, plus SCA for dependencies; coverage is the union.
The operational constraints
Coverage is the weakness: a scanner only tests what it can reach, so authenticated areas need configured credentials, single-page apps need JS-rendering-aware crawlers, and APIs need their schema (OpenAPI) fed in or they’re invisible. Speed: real crawling and fuzzing is slow — full DAST typically runs against staging on a schedule, not on every commit like SAST. Safety: DAST actively attacks, so pointing it at production risks triggering real side effects (test data creation, emails, even destructive actions) — run it against dedicated environments. Modern DAST/IAST hybrids instrument the running app to combine DAST’s realism with code-level pinpointing.
What people get wrong
- DAST or SAST as either/or — they find disjoint vulnerability classes; pick both.
- Unauthenticated scans that test only the login page and miss the entire application behind it.
- Scanning production and triggering the very side effects the “attack” simulates.
Primary source: OWASP — Dynamic Application Security Testing
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.