DAST: Probing a Running App for Security Flaws

WHY IT EXISTS Static code analysis can't find every security issue, especially those that only appear at runtime. Problems like server misconfigurations or vulnerabilities arising from the interaction of multiple services are invisible until the application is running. DAST was created to test a fully deployed system from an attacker's perspective.

THE MENTAL MODEL DAST is black-box security testing. Imagine giving a security expert only the URL of your web app and asking them to find ways to break in. They don't have the source code; they can only interact with the live application, sending it malicious inputs and analyzing the responses. Automated DAST tools do exactly this, but at scale.

HOW IT WORKS A DAST tool is given a target, like a web application's URL. It first crawls the application to map out all its pages, forms, and API endpoints. Then, it launches a series of pre-defined attack patterns against every input it finds. For example, it might try submitting SQL injection payloads into login forms or cross-site scripting (XSS) attacks into comment fields. The tool then analyzes the application's responses to see if any of the attacks succeeded, flagging potential vulnerabilities.

WHEN TO USE IT Use DAST in a staging or QA environment as part of a CI/CD pipeline. It excels at finding common, well-understood vulnerabilities in a running web application before it goes to production. It's a final check on the deployed artifact, not just the code that built it.

WHEN NOT TO USE IT DAST is not a complete security solution. Because it operates from the outside without seeing the source code, it is ineffective at finding certain types of flaws. It typically misses business logic errors (e.g., a flaw allowing a user to illegitimately add funds to their account), race conditions, and some zero-day vulnerabilities. For this reason, it should be paired with static analysis (SAST).

ONE CANONICAL EXAMPLE A DAST scanner is configured to run against a new user profile page in a staging environment. The scanner discovers a form field for 'username'. It automatically submits the payload <script>alert('XSS')</script>. When the profile page is reloaded, a browser alert pops up. The DAST tool flags this as a reflected cross-site scripting (XSS) vulnerability, fails the build, and alerts the team.