DAST
Dynamic Application Security Testing — a method of testing running applications for security vulnerabilities by simulating attacks.
التعريف
DAST tools test applications in their running state by sending malicious inputs and analyzing responses. They can find vulnerabilities that only appear at runtime, like authentication flaws, session management issues, and server misconfigurations. DAST doesn't require source code access, making it suitable for testing third-party applications. Popular DAST tools include OWASP ZAP, Burp Suite, and Acunetix.
لماذا هو مهم
DAST catches vulnerabilities that SAST cannot detect, such as runtime configuration errors and authentication bypasses. It tests the application as an attacker would see it. According to Veracode, combining SAST and DAST detects 70% more vulnerabilities than either alone.
مثال
A DAST scanner automatically tests a web application's login page with various SQL injection payloads, discovering that certain input patterns cause the application to leak database error messages.