DAST - Dynamic Application Security Testing
Sidebar: Testing → DAST Scans (/scans)
DAST tests your running application the way an attacker would: it crawls the app, sends real attack payloads, and confirms what actually works. Unlike static analysis, it needs no source code (though attaching source enables deeper gray-box testing).
The two-stage pipeline
Every scan runs as two visible stages:
The first stage discovers and attacks; the second uses AI to validate, explain and (where enabled) prove exploitability with an agentic loop. For the full phase-by-phase breakdown see the Scan Pipeline architecture.
What DAST tests
Coverage spans the OWASP Top 10 and beyond, including:
- Injection - SQLi, command injection, template injection.
- XSS - reflected, stored, and DOM-based (via a real headless browser).
- Access control - IDOR / broken object-level authorization.
- Authentication - weak/auth-bypass flows.
- SSRF, business-logic flaws, security misconfiguration.
- Schema fuzzing for APIs.
Gray-box testing
When a target has source code attached, DAST becomes source-informed: it knows the routes, parameters and sink locations, so it crafts far more precise attacks and produces higher-confidence findings.
Where results go
- The scan detail page shows live progress, the attack map, coverage and per-finding proof-of-exploit - see Reading scan results.
- Findings are unified into the Vulnerabilities hub.
- Each run is recorded as an Assessment.
Next
- Running a scan - the new-scan wizard and profiles.
- Authenticated scanning - test logged-in surface.
- Reading scan results - interpret the detail page.