Dynamic Analysis (DAST)
What it is
Dynamic Application Security Testing (DAST), or dynamic analysis, tests a running application by interacting with it as a real user — sending requests and observing responses — to find vulnerabilities that only exist at runtime. It is a black-box technique: it doesn’t need the source code.
Why it exists
Some vulnerabilities only appear when the app actually executes: auth/session handling, access-control flaws, injection and input-validation issues reachable through the public interface, and misconfigurations in how the running service behaves. DAST exercises the app in a live environment to catch what SAST (which never executes code) cannot.
Key ideas
- Black-box / executed — observes the app from the outside (HTTP/API), like an attacker.
- Finds runtime issues — session management, CSP/TLS config, SQL-injection and XSS against live endpoints, open endpoints, unsafe redirects.
- Runs in a deployed/test environment — needs the app up (test env, staging, or pre-prod), then replays requests.
- Feeds the gate — results can block a deployment/release gate if critical issues are found.
- Limits — can’t inspect internal logic, unreachable code, or issues that need a specific code path that the exercised requests don’t hit (that’s SAST’s strength).
Example tools
OWASP ZAP (open-source, scriptable), Burp Suite, and commercial DAST integrated into CI/CD/release pipelines.
How it fits
Integer of the shift-left DevSecOps toolkit and the “runtime” counterpart to SAST. Typical pipeline: SAST at build/PR on source → DAST against the deployed app in a test/staging stage → results in a compliance gate.
Exam notes
- DAST = dynamic / black-box / executing / running app — memorized pairing (contrast SAST = static/source).
- Cannot use it in CI without a runnable environment — deeper scans run in release/test stages.
- SAST = static vs DAST = dynamic: exam asks “which finds this?” — runtime behavior → DAST; code defect → SAST.
- Both are inputs to automated security/compliance gates in the pipeline.
Related
dev-sec-ops · static-analysis · software-composition-analysis · compliance-gate
📘 Source: Microsoft Learn — Dynamic Analysis