A scanner or tester sends requests, changes inputs, and follows application flows much as an external client would. The method generally does not require source code and can exercise the combined behavior of application code, frameworks, configuration, and supporting services.
DAST findings are based on requests, responses, and observable effects. This can provide practical evidence for reachable input-validation, authentication, session, transport, or server-configuration weaknesses. Coverage depends on whether the test can discover endpoints, authenticate correctly, reach relevant states, and recognize an unsafe response.
Key points
Evidence examinedLive endpoints, protocols, requests, responses, session behavior, errors, and other effects visible from the tester’s position.
Typical findingsInjection behavior, cross-site scripting, exposed information, weak transport settings, session problems, and some authentication or access-control failures.
Sound operationObtain authorization, define scope, use appropriate test accounts and data, protect availability, preserve reproducible evidence, and retest confirmed fixes.
Important limitationAn automated scan explores only the attack surface and workflows it can reach. Client-side complexity, unlinked APIs, multi-step business logic, and role-specific states can create substantial blind spots.