DAST

Problem

Some vulnerabilities become visible only when the application is actually running. The source may look reasonable, but the deployed application behaves insecurely.

Solution — Dynamic Application Security Testing

Tools such as ZAP and Burp Suite Scanner test a running application's URL, optionally using test-account credentials. They discover pages and API endpoints, send HTTP requests with modified inputs, and inspect responses for vulnerabilities such as SQL injection or cross-site scripting (XSS). A CI pipeline can run the scan after deploying the application to a test environment and report findings for developers to fix.

Security scanner
      ↓ requests
Running application
      ↓
Observed behaviour

Core idea: DAST looks for vulnerabilities through the behaviour of a running application.