Definition:
Dynamic Application Security Testing (DAST) is a security testing method that analyzes a running application from the outside (like a hacker would) to find vulnerabilities. It tests the application in its operational state by sending malicious inputs and observing how it responds, without access to the source code.
Key idea: “Black-box” testing that attacks your app while it’s running to find security holes before real hackers do.
Why It Matters
Without DAST:
❌ Security flaws discovered after deployment ❌ Only find issues hackers exploit first ❌ Expensive breaches and data leaks ❌ Compliance violations
With DAST:
✅ Find runtime vulnerabilities early ✅ Test real-world attack scenarios ✅ No source code access needed ✅ Works on any technology stack
Example:
Testing a Login Form
Normal User:
┌─────────────────────────┐
│ Login Form │
├─────────────────────────┤
│ Username: alice │
│ Password: •••••• │
│ [Login] │
└─────────────────────────┘
↓
✅ Login successful
DAST Scanner (Attacking):
┌─────────────────────────────────────────┐
│ Login Form │
├─────────────────────────────────────────┤
│ Username: admin' OR '1'='1 │ ← SQL injection
│ Password: anything │
│ [Login] │
└─────────────────────────────────────────┘
↓
⚠️ Logged in as admin! VULNERABILITY FOUND!
┌─────────────────────────────────────────┐
│ Username: <script>alert('XSS')</script> │ ← XSS attack
│ Password: test │
│ [Login] │
└─────────────────────────────────────────┘
↓
⚠️ Script executed! VULNERABILITY FOUND!
┌─────────────────────────────────────────┐
│ Username: alice │
│ Password: (empty) │ ← Empty field
│ [Login] │
└─────────────────────────────────────────┘
↓
✅ Error handled properly - No vulnerability