Security9 min read

DAST - Dynamic Application Security Testing

Black-box testing of running applications to detect runtime vulnerabilities and security misconfigurations.

Ing. Gleb Kushnir, founder · Updated

What is Dynamic Application Security Testing?

DAST is an automated process of testing a running application from an external perspective (black-box testing) to identify security vulnerabilities that are only visible at runtime. Unlike SAST, which analyzes source code, DAST tests the application the same way an attacker would attempt to compromise it - by sending malicious requests, manipulating parameters, and looking for security gaps in the running system.

DAST vs. SAST - Key Differences

Property DAST (Dynamic) SAST (Static)
When it tests Runtime - the application must be running Build time - static code analysis
Code access Black-box - does not require source code White-box - requires access to code
What it detects Runtime vulnerabilities, configuration and deployment issues Coding errors, unsafe patterns, potential vulnerabilities
False positives Low - tests actual behavior Higher - may flag safe code
Speed Slower (hours for large applications) Faster (minutes)
Vulnerability types SQL injection, XSS, CSRF, auth issues, SSRF Buffer overflows, race conditions, unsafe functions
Language Language-agnostic (tests HTTP API) Language-specific (Java, C#, Python...)
SDLC phase QA, Staging, Pre-production Development, PR reviews

Best Practice: Combine SAST + DAST

You achieve the best results by combining both approaches. SAST reveals potential problems in code during development, while DAST verifies whether these vulnerabilities are exploitable in a real environment. This strategy is called "Defense in Depth" and covers both theoretical and practical security gaps.

How DAST Works

Typical DAST Scan Workflow

1
Crawling (Spider) The scanner browses the application like a regular user, mapping all pages, forms, parameters, and endpoints
2
Attack Surface Mapping Identifies entry points (input fields, URL params, headers, cookies) where it can perform tests
3
Fuzzing & Injection Sends malicious payloads (SQL injection, XSS, command injection) to all entry points
4
Response Analysis Analyzes HTTP responses, error messages, and timing patterns to detect vulnerabilities
5
Vulnerability Confirmation Verifies false positives and generates a detailed report with PoC (Proof of Concept)
6
Reporting Creates a prioritized list of vulnerabilities with CVSS scores, remediation steps, and reproduction instructions

What DAST Detects

1. Injection Attacks

  • SQL Injection: Manipulation of database queries through user input
  • Command Injection: Execution of OS commands through unsanitized input
  • LDAP/XML/XPath Injection: Injection into specific query languages
  • Template Injection: SSTI (Server-Side Template Injection)

2. Cross-Site Scripting (XSS)

  • Reflected XSS: Malicious script in URL/parameter reflected back to the user
  • Stored XSS: Persistent XSS stored in the database
  • DOM-based XSS: Client-side XSS through JavaScript manipulation

3. Authentication and Session Management

  • Broken Authentication: Weak passwords, session hijacking, credential stuffing
  • Session Fixation: Attacker fixes the victim's session ID
  • Insecure Session Cookies: Missing Secure/HttpOnly/SameSite flags
  • JWT Vulnerabilities: Weak signing, algorithm confusion

4. Broken Access Control

  • IDOR (Insecure Direct Object References): Accessing other users' objects by changing the ID
  • Path Traversal: Accessing files outside webroot (../../../etc/passwd)
  • Privilege Escalation: Regular user gains admin privileges
  • Missing Function Level Access Control: API endpoints without authorization

5. Security Misconfiguration

  • Verbose Error Messages: Stack traces revealing internal information
  • Default Credentials: Admin/admin, root/root
  • Directory Listing: Visible directory structures
  • Missing Security Headers: CSP, HSTS, X-Frame-Options
  • Exposed Admin Panels: /admin, /phpmyadmin, /wp-admin without protection

6. Other Runtime Vulnerabilities

  • CSRF (Cross-Site Request Forgery): Unauthorized actions on behalf of a user
  • SSRF (Server-Side Request Forgery): Server makes a request to an attacker-chosen target
  • XXE (XML External Entity): Reading files through the XML parser
  • Insecure Deserialization: RCE through deserialization of untrusted data
  • Business Logic Flaws: Race conditions, price manipulation

Popular DAST Tools

Open Source / Free

ZAP (Zed Attack Proxy)

Open-source DAST tool with GUI and CLI modes, formerly known as OWASP ZAP. Since September 2024 it has been branded ZAP by Checkmarx and remains open source under the Apache 2.0 license.

  • Active and passive scanning
  • Intercepting proxy for manual testing
  • Spidering and automatic crawling
  • API scan (REST, GraphQL, SOAP)
  • CI/CD integration (Docker, Jenkins, GitLab)
  • Official Docker image zaproxy/zap-stable (the former owasp/zap2docker-stable is no longer used)
Commercial / Freemium

Burp Suite Professional

Industry-standard penetration testing platform with advanced features for both manual and automated testing.

  • Burp Scanner - automated vulnerability scanner
  • Intruder - advanced fuzzing engine
  • Repeater - request manipulation
  • Collaborator - out-of-band detection (SSRF, XXE)
  • Extensions (BApp Store)
  • Paid Professional license per user per year, current price on the PortSwigger website
Open Source

Nuclei

A modern fast vulnerability scanner based on YAML templates. Ideal for CI/CD automation.

  • Community template library nuclei-templates
  • Fast parallel scanning
  • Custom templates in YAML
  • Integration with Slack, Jira, GitHub
  • Headless browser support
Commercial SaaS

Acunetix (Invicti Web + API)

Commercial web vulnerability scanner that Invicti now offers as Invicti Web + API. It also targets SPAs and JavaScript-heavy applications.

  • Advanced JavaScript/SPA crawling
  • Web API scanning
  • Issue tracking (Jira, GitHub, GitLab)
Open Source

Nikto

A classic web server scanner for detecting known vulnerabilities and misconfigurations.

  • Over 8,000 potentially dangerous files and programs
  • Outdated server versions detection
  • Server misconfigurations
  • Fast, lightweight CLI tool
Cloud / API-focused

StackHawk

A modern DAST platform focused on API security and a developer-first workflow.

  • OpenAPI/Swagger integration
  • GraphQL endpoint testing
  • CI/CD native (GitHub Actions, GitLab CI)
  • Developer-friendly reporting
  • Shift-left DAST approach

Practical Example: OWASP ZAP in CI/CD

Integrating ZAP into a GitLab CI/CD pipeline. Instead of the deprecated only/except keywords it uses rules:

# .gitlab-ci.yml stages: - build - test - security - deploy # DAST scan using OWASP ZAP dast_scan: stage: security image: zaproxy/zap-stable variables: TARGET_URL: "https://staging.example.com" script: # Reports are written to /zap/wrk - mkdir -p /zap/wrk # Baseline scan (passive + spider), -I: warnings (WARN) do not fail the job - zap-baseline.py -t $TARGET_URL -r zap-report.html -J zap-report.json -I # Full scan (active attacks) - can be used for staging # - zap-full-scan.py -t $TARGET_URL -r zap-report.html -J zap-report.json # API scan with OpenAPI spec # - zap-api-scan.py -t $TARGET_URL/openapi.json -f openapi -r api-report.html after_script: - cp /zap/wrk/zap-report.* "$CI_PROJECT_DIR/" artifacts: paths: - zap-report.html - zap-report.json expire_in: 1 week allow_failure: false # Block deployment on FAIL findings rules: - if: $CI_PIPELINE_SOURCE == "merge_request_event" - if: $CI_COMMIT_BRANCH == "main"

GitHub Actions Example

The example uses zaproxy/action-baseline v0.15.0. If you upload artifacts yourself, actions/upload-artifact@v3 has been unsupported since November 2024.

name: DAST Scan on: push: branches: [ main, staging ] pull_request: branches: [ main ] jobs: zap_scan: runs-on: ubuntu-latest name: OWASP ZAP Scan steps: - name: Checkout code uses: actions/checkout@v7 - name: Deploy to staging run: | # Deploy application to staging for testing docker compose up -d sleep 30 # Wait for application startup - name: ZAP Baseline Scan uses: zaproxy/action-baseline@v0.15.0 with: target: 'http://localhost:3000' rules_file_name: '.zap/rules.tsv' cmd_options: '-a' allow_issue_writing: false artifact_name: zap-scan-report # The action uploads the reports (HTML, JSON, MD) itself as the # zap-scan-report artifact; no separate actions/upload-artifact step needed - name: Fail build on high severity run: | # Parse JSON report, fail on High alerts (riskcode 3) HIGH_COUNT=$(jq '.site[0].alerts | map(select((.riskcode | tonumber) >= 3)) | length' report_json.json) if [ "$HIGH_COUNT" -gt 0 ]; then echo "Found $HIGH_COUNT high risk alerts!" exit 1 fi

Docker Compose for Local DAST Testing

The version key in Compose files is obsolete and the command runs as docker compose.

# compose.yaml services: app: build: . ports: - "3000:3000" environment: NODE_ENV: test DATABASE_URL: postgres://user:pass@db:5432/testdb db: image: postgres:15 environment: POSTGRES_PASSWORD: pass POSTGRES_DB: testdb zap: image: zaproxy/zap-stable command: zap-baseline.py -t http://app:3000 -r /zap/wrk/report.html volumes: - ./zap-reports:/zap/wrk depends_on: - app # Usage: # docker compose up -d app db # docker compose run zap # Report will be in ./zap-reports/report.html

DAST Best Practices

Recommended Practices

  • Test on staging/QA, not on production: DAST can cause DOS, data corruption, or trigger alarms
  • Use test credentials: Dedicated test accounts for authenticated scanning
  • Rate limiting awareness: DAST generates many requests; you may be blocked by WAF/CDN
  • Baseline vs Full scan: Baseline for every PR, Full scan weekly or before release
  • Custom scan policies: Disable tests that are not relevant (e.g., CMS scan for an API-only app)
  • Authentication context: Configure ZAP/Burp for the login workflow; test authenticated areas
  • API specification: Use OpenAPI/Swagger specs for better coverage of API endpoints
  • False positive management: Review and mark FPs; create whitelists
  • Trend tracking: Monitor the number of vulnerabilities over time, not just the current state
  • SIEM integration: Send DAST findings to a centralized security dashboard

Common DAST Mistakes

  • Running DAST on production: Can cause outages, corrupt data, or false alarms
  • Insufficient crawling scope: Scanner fails to find all endpoints (especially with SPAs)
  • Ignoring false positives: Teams lose trust in the tool
  • Automated scans only: Manual pentesting finds business logic flaws that DAST cannot detect
  • No authentication: Most features usually sit behind login; scanning only the homepage is insufficient
  • One scan = done: DAST should run continuously, not just before release
  • Outdated scanners: New CVEs and attack vectors require fresh vulnerability checks

DAST for Different Application Types

1. REST API

In zap-api-scan.py the -t option points to the API definition, -O overrides the hostname and -d only enables debug output.

# OWASP ZAP API scan with OpenAPI spec zap-api-scan.py \ -t api-spec.yaml \ -f openapi \ -O https://api.example.com \ -r api-security-report.html \ -J api-report.json \ -x api-xml-report.xml # Postman Collection import into ZAP # 1. Export Postman collection # 2. Import into ZAP as "context" # 3. Run Active Scan on imported endpoints

2. GraphQL API

ZAP supports GraphQL through its GraphQL add-on. Note: GraphQL Armor by Escape is server-side middleware that protects an API, not a scanner.

# ZAP API scan for a GraphQL endpoint zap-api-scan.py -t https://api.example.com/graphql -f graphql \ -r graphql-report.html # Introspection query for schema mapping curl -X POST https://api.example.com/graphql \ -H "Content-Type: application/json" \ -d '{"query": "{__schema{types{name fields{name}}}}"}' # ZAP GraphQL add-on # Imports the schema, generates queries from it for the active scan # and reports, among others: # - enabled introspection # - identified GraphQL server implementation # - circular references in the schema

3. Single Page Applications (SPA)

For modern web apps ZAP recommends the Client Spider. Nuclei runs templates that need a browser only with the -headless flag.

# ZAP in daemon mode for React/Vue/Angular apps zap.sh -daemon -port 8080 -config api.disablekey=true # Client Spider (recommended over the older AJAX Spider) # crawls the app in a headless browser and reads the DOM curl 'http://localhost:8080/JSON/clientSpider/action/scan/?url=https://app.example.com' # Or Nuclei with headless mode nuclei -u https://app.example.com \ -headless \ -o spa-scan-results.txt

DAST vs IAST vs RASP

Tool How It Works Advantages Disadvantages
DAST
(Dynamic)		 Black-box testing of a running application from the outside No code access needed, language-agnostic, low false positives Slow, does not pinpoint exact code location, requires a running application
SAST
(Static)		 Source code analysis without execution Fast, early detection, exact code location Higher false positives, language-specific, cannot see runtime issues
IAST
(Interactive)		 Agent inside the application monitoring runtime behavior Accurate, low FP, code-level insights + runtime context Requires instrumentation, performance overhead
RASP
(Runtime Protection)		 Active defense in production - blocks attacks in real time Production security, zero-day protection, virtual patching Performance impact, false positives can block legitimate users

Sources

  1. ZAP: Docker images (October 2026)
  2. ZAP Blog: ZAP has joined forces with Checkmarx (September 2024)
  3. ZAP: API Scan (October 2026)
  4. ZAP: Client Spider (October 2026)
  5. ZAP: GraphQL Support add-on (October 2026)
  6. GitHub: zaproxy/action-baseline (October 2026)
  7. GitHub: actions/upload-artifact (October 2026)
  8. GitLab Docs: Deprecated keywords (only / except) (October 2026)
  9. Docker Docs: Compose file version and name (October 2026)
  10. CIRT.net: Nikto (October 2026)
  11. Invicti: Acunetix (Invicti Web + API) (October 2026)
  12. ProjectDiscovery: Running Nuclei (October 2026)

More on this topic

Want this handled without building your own DevOps team?

Our four-person DevOps team runs your platform for a fixed monthly price.

Or write to info@devsecops.cz. We process your data under our privacy policy.