DAST
Dynamic Application Security Testing — a method of testing running applications for security vulnerabilities by simulating attacks.
定义
DAST tools test applications in their running state by sending malicious inputs and analyzing responses. They can find vulnerabilities that only appear at runtime, like authentication flaws, session management issues, and server misconfigurations. DAST doesn't require source code access, making it suitable for testing third-party applications. Popular DAST tools include OWASP ZAP, Burp Suite, and Acunetix.
为什么重要
DAST catches vulnerabilities that SAST cannot detect, such as runtime configuration errors and authentication bypasses. It tests the application as an attacker would see it. According to Veracode, combining SAST and DAST detects 70% more vulnerabilities than either alone.
示例
A DAST scanner automatically tests a web application's login page with various SQL injection payloads, discovering that certain input patterns cause the application to leak database error messages.