# What is Dynamic Application Security Testing (DAST)?

> Dynamic application security testing evaluates a running application by interacting with its exposed interfaces and observing the resulting behavior.

- Canonical URL: https://yellowcube.eu/glossary/dynamic-application-security-testing/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

A scanner or tester sends requests, changes inputs, and follows application flows much as an external client would. The method generally does not require source code and can exercise the combined behavior of application code, frameworks, configuration, and supporting services.

DAST findings are based on requests, responses, and observable effects. This can provide practical evidence for reachable input-validation, authentication, session, transport, or server-configuration weaknesses. Coverage depends on whether the test can discover endpoints, authenticate correctly, reach relevant states, and recognize an unsafe response.

### Key points

- **Evidence examined:** Live endpoints, protocols, requests, responses, session behavior, errors, and other effects visible from the tester’s position.
- **Typical findings:** Injection behavior, cross-site scripting, exposed information, weak transport settings, session problems, and some authentication or access-control failures.
- **Sound operation:** Obtain authorization, define scope, use appropriate test accounts and data, protect availability, preserve reproducible evidence, and retest confirmed fixes.
- **Important limitation:** An automated scan explores only the attack surface and workflows it can reach. Client-side complexity, unlinked APIs, multi-step business logic, and role-specific states can create substantial blind spots.

### Related terms

[Static application security testing (SAST)](<https://yellowcube.eu/glossary/static-application-security-testing/>) · [Penetration testing](<https://yellowcube.eu/glossary/penetration-testing/>) · [Web application security](<https://yellowcube.eu/glossary/web-application-security/>) · [Attack surface](<https://yellowcube.eu/glossary/attack-surface/>) · [Structured Query Language (SQL) injection](<https://yellowcube.eu/glossary/structured-query-language-injection/>)

### Sources

[OWASP Web Security Testing Guide](https://owasp.org/www-project-web-security-testing-guide/) · [NISTIR 8397, Guidelines on Minimum Standards for Developer Verification of Software](https://www.nist.gov/publications/guidelines-minimum-standards-developer-verification-software)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.