thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Out-of-Band Application Security Testing (OAST)

Testing that detects blind vulnerabilities by observing callbacks, such as DNS or HTTP requests, from the target to a tester-controlled server.

Definition

OAST reveals blind vulnerabilities such as blind SSRF, blind XXE, blind SQL injection and asynchronous injection that do not show in the HTTP response. Many DAST tools include an OAST collaborator service.

Example

A DAST scan detects blind SSRF when the target makes a DNS lookup to the scanner's unique callback domain.

Exam tip

Use OAST for blind/asynchronous flaws that normal DAST misses.

Related terms