Secure › Module 8 › Lesson 1
DAST Named
Dynamic analysis hits running apps — concept on YOUR local lab URL only.
Visual · t17_dast_named
DAST = probe running app like a client would. Original Cyberlium.
Opening
DAST finds the hole your unit tests never visited — but only on servers you are allowed to hammer.
Dynamic Application Security Testing sends HTTP requests to a live app to find XSS, misconfig headers, cookie issues, and exposed endpoints. Tools include OWASP ZAP and Burp Scanner modes — used against YOUR lab instance on localhost or $LAB_URL you deploy. DAST is noisy and needs scope rules. Never aim DAST at employer production, school portals, SaaS you do not own, or 'just checking' public sites — that is unauthorized testing. Pair DAST findings with SAST and manual review on $REPO.
1. SAST vs DAST
SAST: source without running. DAST: HTTP to running build with routes and config live.
DAST catches deployment mistakes SAST misses — wrong headers, debug endpoints enabled.
Command guide
Try these commands — SAST vs DAST
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
DAST overview — https://owasp.org/www-project-web-security-testing-guide/ OWASP ZAP — https://www.zaproxy.org/ (127.0.0.1 toy only)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('DAST = probe running app — scope 127.0.0.1:8820 only')"
curl -sS https://www.zaproxy.org/ | head -8Primary tools to practice this lesson: curl, python3. Reference sites: DAST overview (https://owasp.org/www-project-web-security-testing-guide/); OWASP ZAP (https://www.zaproxy.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Tool literacy
ZAP baseline scan for CI smoke; authenticated scan needs test creds you created in lab.
Scope URL must match RoE — single host/path prefix.
3. Ethics
Target $LAB_URL or localhost only in course labs.
Written authorization required for any non-owned environment — default is refuse.
4. What you ship: DAST vocabulary
DAST definition + SAST contrast + $LAB_URL-only scope.
5. What you record before the next lesson
DAST named paragraph.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run ZAP active scan against university login portal.
Right
Name DAST vs SAST. Next: lab-only DAST.
Mission: DAST literacy notes
1) Define DAST in one sentence. 2) Contrast with SAST. 3) Write NEVER DAST stranger production.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “ZAP baseline vs full scan?”
Knowledge Check
APPLY: DAST requires:
Multiple choice
Knowledge Check
APPLY: True or False: DAST on stranger SaaS is homework.
True or False
Knowledge Check
APPLY: DAST may find:
Multiple choice