What is DAST?

Last updated: Oct 21, 2026

---

Dynamic application security testing (DAST) is a security testing technique that detects security vulnerabilities in a running application.

Unlike static application security testing, DAST does not use the source code. DAST uses different attack vectors to find weaknesses in the configuration, data handling, and business logic of the application. With this method, you can find vulnerabilities that attackers can exploit from the user side of the application. An inspection of the source code alone can miss these vulnerabilities.

To learn more about the Fluid Attacks DAST capabilities, see these resources in this documentation:

• Security requirements verified with DAST: Learn about the technology that Fluid Attacks supports and the security requirements that DAST tests:
  • API: Test the security of your API endpoints and the data that they return.
  • DNS: Test the security of your Domain Name System records.
  • HTTP: Examine the security of web applications with an analysis of HTTP requests and responses.
  • SSL: Examine the strength and configuration of your SSL/TLS certificates and encryption protocols.
• Configure the tests by the standalone scanner: Do DAST with the Fluid Attacks command-line interface (CLI) tool.
• Sign up to Fluid Attacks: Start the free trial of DAST and other Fluid Attacks automated techniques. Fluid Attacks configures the scanner for you. The scanner monitors the security of your system continuously while you develop. Fluid Attacks gives you reports, analytics, and remediation suggestions on its platform.