DAST (Dynamic Application Security Testing)
DAST (Dynamic Application Security Testing) is a black-box method that tests a running application from the outside by sending crafted inputs and observing responses, uncovering vulnerabilities such as injection, authentication flaws, and misconfigurations without access to the source code.
DAST probes a live, deployed application the way an attacker would. It has no knowledge of the internal source code; instead it interacts through the app's exposed interfaces (HTTP endpoints, APIs, forms), sends malicious or malformed payloads, and analyzes the resulting behavior and responses to infer weaknesses.
A typical DAST run first crawls the application to discover pages, parameters, and endpoints, then launches attacks such as injecting SQL, script payloads, or path traversal sequences. Because it observes real runtime behavior, DAST is well-suited to finding server misconfigurations, broken authentication and session handling, and issues that only appear once the full stack is running.
For developers, DAST validates the application as actually deployed, complementing static analysis. Its trade-offs are that it usually runs later in the lifecycle (a working environment is required), can be slower, and often reports a symptom without pinpointing the exact line of code responsible.