DAST (Dynamic Application Security Testing).

DAST tools interact with a deployed application — usually via HTTP — without needing source code. They crawl endpoints, send crafted requests, and observe responses to detect issues such as SQL injection, XSS, SSRF, broken authentication, misconfigured CORS or insecure cookies. Because they see what an attacker would see, DAST complements SAST by catching runtime-only problems, including those arising from configuration, infrastructure or third-party services. DAST is typically run in staging or QA environments and integrated into CI/CD as a release gate. Common tools include OWASP ZAP, Burp Suite, Invicti, Acunetix and StackHawk.

How it works

A DAST scan runs in two phases. First, a crawler (spider) maps the application's attack surface by following links, parsing JavaScript, and replaying recorded traffic to discover forms, parameters and API routes. Second, an active scanner mutates each input with attack payloads and infers vulnerabilities from response codes, timing, reflected content or error signatures — for example, a time-based blind SQL injection is confirmed when a SLEEP() payload measurably delays the response.

Modern DAST has shifted toward API-first and authenticated scanning: single-page apps and REST/GraphQL back-ends expose little to a naive crawler, so scanners consume OpenAPI/Swagger specs and use scripted login sequences to reach protected functionality. Coverage is commonly mapped against the OWASP Web Security Testing Guide (WSTG). DAST's limits matter just as much: it produces no line-of-code location, cannot see unreachable code paths, and risks false negatives on complex client-side state — which is why teams pair it with SAST and IAST rather than relying on it alone. To avoid scanning production and triggering real side effects (sending emails, placing orders), scans are gated to non-prod targets and given a defined scope and exclusion list.

flowchart LR
  A[Running app<br/>staging/QA] --> B[Crawler / spider<br/>maps endpoints]
  B --> C[Active scanner<br/>injects payloads]
  C --> D{Anomaly in<br/>response?}
  D -->|Yes| E[Report finding<br/>SQLi / XSS / SSRF]
  D -->|No| F[Mark endpoint clean]
  E --> G[CI/CD gate<br/>fail build / triage]