What is DAST? Explain the importance of web application security and implementation steps

What is DAST?

DAST (Dust, Dynamic Application Security Testing) is a security testing technique that externally inspects applications while they are running.

It accesses web applications as if they were attackers and detects vulnerabilities in their runtime behavior and responses.

Features

• Black Box Testing: Perform inspections without accessing source code
• Inspection in execution environment: can be tested in production or staging environment
• Good at detecting SQL injection, XSS, etc.

Why is DAST important?

1. Security Validation Required Throughout the Development Cycle

DAST is positioned as "post-deployment validation" in CI/CD pipelines, allowing it to detect runtime issues that are not visible through static testing (SAST) and component analysis (SCA).

2. Vulnerabilities can be found in situations close to the real environment

• Through actual HTTP request responses, you can also understand unintentional information exposure and misconfigurations.
• Testing via WAF and CDN is also possible, making it strong in identifying vulnerabilities with high attack potential.

3. External attacker perspective testing is possible

Since it takes the same approach as an attacker, it is possible to assess the risk from the perspective of "whether it can actually be exploited" .

Typical DAST Products

1. OWASP ZAP
   Free, open-source, CI integration possible
2. Burp Suite
   Resistant to manual testing, commercial version is highly functional
3. Acunetix
   Commercial tool, high scanning accuracy
4. Invicti
   High automatic detection accuracy and full reporting functions
5. StackHawk
   GitHub Actions support for development pipelines

Steps to Implement DAST

Step 1: Prepare the Target Application Environment

• Prepare a staging environment or a production-equivalent execution environment
• Allow communication from the scanner in CORS and WAF settings

Step 2: Scan Settings

• Specify URL
• Set up authentication (e.g., login session)
• Set exclusion paths and scan policies

Step 3: Run the Scan

• Run manually or on a schedule
• Pay attention to the load and consider the timing of scanning

Step 4: Report Review and Vulnerability Management

• Review detected vulnerabilities
• Prioritize and plan fixes
• Knowledge sharing to prevent recurrence

Step 5: Automation with CI/CD Integration (if possible)

• Integrates with GitHub Actions, GitLab CI, Azure DevOps, and more
• Perform automatic scans for each pull request

Conclusion

1. What is DAST?
   Inspect running apps from the attacker's perspective from the outside
2. Importance
   Detect realistic risks based on execution environment
3. main tools
   ZAP, Burp Suite, Acunetix, StackHawk, etc.
4. Implementation Procedure
   Environment Build→ Configuration → Execution → Reporting → CI Integration

DAST is very useful for improving the security quality of an application at the execution stage. It can be used not only as a "security check just before production" but also as an automated security gate under development. As part of your ongoing security measures, consider implementing DAST.