🎁 New User? Get 20% off your first purchase with code NEWUSER20 Register Now →
Menu

Categories

Security Intermediate

What is DAST (Dynamic Application Security Testing)?

Testing a running application from the outside by sending malicious requests to discover security vulnerabilities.

DAST tools probe running applications like an attacker would — sending crafted requests to find SQL injection, XSS, authentication flaws, and misconfigurations. Tools include OWASP ZAP (free), Burp Suite, Nikto, and commercial solutions like Acunetix. DAST is language-agnostic since it tests the running application through its interfaces. It finds real, exploitable vulnerabilities with low false positive rates. However, DAST cannot pinpoint the vulnerable code line, requires a running environment, and may miss vulnerabilities in untested code paths. Best practice combines SAST (inside-out) with DAST (outside-in) for comprehensive coverage.

Related Terms

WAF (Web Application Firewall)
A security solution that filters and monitors HTTP traffic between a web application and the internet, blocking common attacks.
Security Headers
HTTP response headers that instruct browsers to enable security features like XSS protection, framing prevention, and content type enforcement.
Session Hijacking
An attack where an adversary takes over a legitimate user session by stealing or predicting the session identifier.
CSRF (Cross-Site Request Forgery)
An attack that tricks authenticated users into submitting unwanted requests to a web application they are logged into.
Input Validation
The process of verifying that user-supplied data meets expected formats, types, and ranges before processing it.
SQL Injection
An attack where malicious SQL code is inserted into application queries through user input to access or manipulate the database.
 View All Security Terms →