From the course: Building an Application Security Program

Unlock the full course today

Join today to access over 25,200 courses taught by industry experts.

Dynamic application security testing (DAST)

Dynamic application security testing (DAST)

From the course: Building an Application Security Program

Start my 1-month free trial Buy for my team

Dynamic application security testing (DAST)

“

- [Instructor] Now we're going to talk about dynamic application security testing. I really like the OWASP definition of dynamic testing, which is, "A black-box testing that can find security vulnerabilities and weaknesses in a running application by injecting malicious payloads to identify potential flaws." My simple definition of this is it's an automated way to hack, but a more technical way to look at this is that DAST, dynamic application security testing, scans websites and APIs for vulnerabilities without the source code. It's black-box testing for security. Static has the source code and all of the different paths that it will take. With dynamic, you don't. You spider the application to know which paths are on the website, and then the tool tries to manipulate all the fields that it finds. Similar to static, the concept is tried and true. Dynamic scans have been around for a while. OWASP has a free one called Zap.…

Contents