Dynamic Application Security Testing (DAST)

Definition

Dynamic Application Security Testing (DAST) is a security testing technique that probes a running application from the outside — sending crafted HTTP requests and observing responses — to find vulnerabilities such as injection flaws, broken authentication, and misconfigurations without access to the application's source code.

Overview

DAST tools operate as automated black-box testers: they treat the application the way an external attacker would, interacting only through its exposed interfaces (typically web pages and APIs) without any visibility into the underlying source code, and without needing the application to be written in any particular language or framework. A typical DAST scan begins with a crawling or discovery phase, mapping out the application's pages, forms, and API endpoints, followed by an attack phase in which the tool systematically submits malicious or malformed inputs — SQL injection payloads, script tags for XSS testing, path traversal sequences, and more — to each discovered input point, then analyzes the responses (error messages, status codes, response content, timing) for signs that the input triggered unintended or vulnerable behavior. Because DAST tests the actual running system, it can catch classes of vulnerabilities that static analysis (SAST) fundamentally cannot see: server and framework misconfigurations, authentication and session-management flaws that only manifest through the live request/response flow, issues in how the application is deployed rather than how it's coded, and vulnerabilities introduced by third-party components or infrastructure the source code doesn't fully reveal. The tradeoff is that DAST runs later in the pipeline (the application must be built and deployed to a test environment first), tends to be slower than SAST, and — because it lacks visibility into code internals — generally cannot pinpoint the exact line of code responsible for a finding, only the vulnerable endpoint or behavior observed. DAST tools range from open-source options like OWASP ZAP (Zed Attack Proxy) to commercial platforms like Burp Suite Professional, Invicti, and Acunetix. DAST is commonly run against staging or QA environments as part of a DevSecOps pipeline, either on a schedule or triggered before a production release, and is often combined with SAST (which catches code-level issues early) and manual penetration testing (which brings human creativity and business-logic understanding that automated scanners lack) for comprehensive coverage across the development lifecycle.

Key Concepts

• Tests a running application from the outside, without access to source code
• Crawls the application to discover pages, forms, and API endpoints automatically
• Submits malicious/malformed inputs and analyzes responses for vulnerable behavior
• Detects runtime issues SAST cannot see: misconfigurations, live auth/session flaws
• Language- and framework-agnostic, since it interacts only through exposed interfaces
• Runs later in the pipeline, against a deployed test or staging environment
• Generally cannot pinpoint the exact source-code line responsible for a finding
• Commonly paired with SAST and manual penetration testing for broader coverage

Use Cases

Frequently Asked Questions

Related in Cybersecurity