Dynamic Application Security Testing

Dynamic Application Security Testing, or DAST, checks a running application for security weaknesses by interacting with it the way an attacker would, without looking at its source code. A DAST tool sends unexpected or malicious input to a live app and watches how it responds, which catches problems like injection flaws or broken login checks that only show up once the software is actually running.

itOffensive security and application security

Dynamic Application Security Testing

Dynamic Application Security Testing (DAST) is a non-functional testing process that identifies security weaknesses and vulnerabilities in an application by interacting with it while it runs. A DAST tool talks to your application through its front end, the same way a browser or an API client would, and looks for behavior that reveals a flaw.

The useful mental model is black-box interaction with a live target:

crawl the app → send probing input → observe the response → triage the finding
       ↑                                                          ↓
       └──────────────── expand coverage, rescan, retest ─────────┘

DAST tools do not read your source code. They do not know your framework, your language, or your internal architecture. They only know what the application exposes at its interfaces — pages, forms, headers, cookies, and API endpoints — and what it does when it receives something unusual.

What DAST tests, and what it does not

DAST is one member of a family of application security testing techniques, and each one inspects a different slice of the application:

Dynamic Application Security Testing

What DAST tests, and what it does not

Relevant careers