A penetration tester is performing DAST (Dynamic Application Security Testing) on a web application. Which characteristic distinguishes DAST from SAST (Static Application Security Testing)?

Question

Accepted Answer

B. DAST tests the running application by sending inputs and analyzing responses. Dynamic Application Security Testing (DAST) tests a running application by interacting with it — sending inputs, manipulating requests, and analyzing responses — from the outside, without requiring access to source code. This makes it the appropriate technique when source code is unavailable, as in black-box testing. SAST analyzes source code or compiled binaries without executing the application.

A penetration tester is performing DAST (Dynamic Application Security Testing) on a web application. Which characteristic distinguishes DAST from SAST (Static Application Security Testing)?

Related Questions

Discussion