thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

DevOps & Automation · Intermediate

Dynamic Application Security Testing (DAST)

Testing a running application from the outside by sending crafted requests to find vulnerabilities.

Definition

DAST is black-box and language-agnostic, finding runtime issues such as XSS, misconfigurations, and authentication flaws. Tools include OWASP ZAP and Burp Suite. It runs against a deployed test environment.

Example

An OWASP ZAP baseline scan runs against the staging URL after deployment.

Exam tip

DAST needs a running app, so it appears later in the pipeline than SAST.

Don't confuse it with

Related terms