DAST (dynamic analysis)
DAST · dynamic application security testing · dynamic analysis · web vulnerability scanner · black-box testing · analyse dynamique
Automated testing of a running application, sending it requests the way an attacker would in order to observe its reactions and detect exploitable flaws.
In practice
The scanner crawls pages and APIs, slips booby-trapped values into fields and analyses the responses: overly verbose error messages, scripts echoed back unchanged, missing security headers. Because it does not need the source code, it also suits bought-in or legacy applications. It sees what static analysis misses (server configuration, cookies, TLS), but cannot point to the faulty line of code. It is run against a pre-production environment, or in production only with a written scope and authorisation, since some tests create data or slow the service down.
Fictional case: before a customer portal opens, a dynamic scan of pre-production shows that a search page echoes the typed text without neutralising it, opening the door to an XSS attack. The fix ships before go-live.
How to protect yourself
- Scan every release in pre-production, using test accounts.
- Cover the APIs, not just the visible pages.
- Have a human validate findings before closing them.
