What DAST Is
Dynamic Application Security Testing (DAST) is "black-box" testing. It does not see your source code at all. Instead, it attacks your running application from the outside, exactly like a real attacker would — probing endpoints, submitting malicious payloads, and observing how the application responds.
How DAST Works
You first deploy your application to a staging or test environment. The DAST scanner then acts as an automated penetration tester: it crawls your web application to discover all endpoints, forms, and API routes, then systematically tries to exploit each one. It submits crafted payloads and analyzes the responses for signs of vulnerability.
Common findings include:
- Cross-Site Scripting (XSS) — Injecting
<script>tags into form fields and checking if they execute in the response. - SQL Injection — Submitting
' OR 1=1 --into login forms and checking for database errors or unexpected access. - Broken authentication — Testing for weak session tokens, missing logout functionality, or predictable password reset flows.
- Security misconfigurations — Detecting exposed admin panels, directory listings, or verbose error messages that leak stack traces.
Popular DAST tools include OWASP ZAP (free, open-source, excellent for CI integration) and Burp Suite (industry-standard for manual and automated testing, commercial).
When it runs: Later in the pipeline, after the application is built, containerized, and deployed to a staging environment. It cannot run against source code — it needs a live HTTP server to talk to.
Pros: Finds real, exploitable vulnerabilities that SAST misses because it tests actual runtime behavior. Very low false-positive rate — if the scanner successfully injected a payload, the vulnerability is real.
Cons: Requires a fully running environment (slower to set up in CI); runs significantly slower than SAST (a full scan can take 30–60 minutes); cannot tell you which line of code caused the vulnerability, only that the endpoint is vulnerable.
Key Point: SAST and DAST are complementary, not competing. SAST finds the root cause in code; DAST confirms exploitability at runtime. A vulnerability found by DAST but not SAST often indicates a logic flaw or a misconfiguration that static analysis cannot model — these are frequently the most severe findings.