We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Security Testing Operations
Free preview: the first 2 parts of this 8-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Security Testing Operations
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
SAST looks at source code. DAST looks at the running application. It sends real HTTP requests with attack payloads ( injection, XSS, command injection, path traversal) and analyzes the responses for signs of vulnerability.
OWASP ZAP, Burp Suite Professional, and Invicti are the most widely used DAST tools. They work in two phases: first, a crawler maps the application by following links, submitting forms, and discovering API endpoints. Then a fuzzer sends attack payloads against every discovered parameter and checks the responses.
When ZAP sends id=1' OR '1'='1 and the server responds with a SQL syntax error, that is a confirmed SQL injection. When it injects <script>alert(1)</script> and the response body contains the unencoded script tag, that is confirmed reflected XSS. This is why DAST has lower false positive rates than SAST: it actually triggers the bug and observes the response.
The flip side: DAST is slow. A full scan of a mid-size web application takes 2-8 hours. It can only test endpoints it can reach, so authenticated areas are missed unless you configure credentials. And DAST cannot tell you which line of code causes the vulnerability, only that it exists at a specific URL and parameter.
Shopify runs DAST against every staging deployment and attributes 15-20% of their vulnerability discoveries to DAST findings that SAST missed, particularly runtime misconfigurations and authentication flow bugs.