DAST is a security testing methodology that analyzes applications while they are running by sending various inputs and monitoring responses to identify security vulnerabilities. It's a "black-box" testing approach that examines the application from an external perspective without access to source code. Key differences from SAST:
DAST (Dynamic): Tests running applications, finds runtime vulnerabilities, requires deployed application, detects issues like authentication bypasses and injection attacks
SAST (Static): Analyzes source code without execution, finds coding vulnerabilities early in development, doesn't require running application, detects issues like buffer overflows and insecure coding patterns DAST simulates real-world attacks and can identify vulnerabilities that only manifest during runtime, such as configuration issues, authentication problems, and business logic flaws.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
