Dynamic Application Security Testing (DAST)

DAST tools probe live applications like an attacker would, sending malicious inputs and analyzing responses.

What DAST detects

• Injection vulnerabilities (SQL, command, LDAP).
• Authentication and session management flaws.
• Server misconfigurations.
• Sensitive data exposure in responses.
• Missing security headers.
• Cross-site scripting (reflected).

Popular DAST tools

• Commercial: Burp Suite Enterprise, Invicti, Rapid7 AppSpider.
• Open source: OWASP ZAP, Nuclei, Nikto.

CI/CD integration

• Run against staging/test environments.
• Schedule full scans nightly or weekly.
• Quick scans on every deployment.
• API-first scanning for modern applications.

Advantages

• Tests the actual running application.
• Finds configuration and deployment issues.
• Technology-agnostic (tests any web application).
• Discovers issues SAST cannot find.

Limitations

• Cannot scan code paths not exposed via UI/API.
• Requires running application (later in pipeline).
• May miss vulnerabilities behind authentication.
• Can generate significant traffic/load.

Best practices

1. Maintain authenticated scan profiles for full coverage.
2. Use API definitions (OpenAPI/Swagger) for API scanning.
3. Exclude rate-limited endpoints to avoid lockouts.
4. Correlate with SAST findings for validation.
5. Run in isolated test environments to avoid data corruption.