DAST: What is Dynamic Security Testing
DAST (Dynamic Application Security Testing) is an analysis technique that tests running applications by simulating real attacks from the outside. Unlike SAST which analyzes source code, DAST interacts with the application via HTTP as an attacker would, looking for vulnerabilities like XSS, SQL injection, CSRF, misconfiguration, and broken authentication.
DAST is a black-box approach: it has no access to the source code and sees the application exactly as a malicious user would. This complements SAST because it finds vulnerabilities that only emerge at runtime, such as configuration issues, missing HTTP headers, and insecure authentication flows.
In this article, we will explore OWASP ZAP and Burp Suite, their integration into CI/CD pipelines, and strategies for implementing automated DAST without slowing down the release cycle.
What You'll Learn
- How DAST works and when to use it in the pipeline
- Configuring OWASP ZAP for automated scans
- API security testing with DAST
- Fuzzing and advanced testing techniques
- DAST integration in the CI/CD pipeline
- Triage and prioritization of results
How DAST Works
A DAST tool follows a structured process to analyze a web application:
- Spider/Crawl: the tool navigates the application discovering all pages, forms, and API endpoints
- Passive Scan: analyzes HTTP responses looking for sensitive information, missing headers, insecure cookies
- Active Scan: sends malicious payloads (SQL injection, XSS payloads, path traversal) and analyzes responses to identify vulnerabilities
- Reporting: generates a report with found vulnerabilities, categorized by severity with remediation instructions
When to Use DAST in the Pipeline
DAST requires a running application, so it typically sits in the later stages of the pipeline:
- Staging environment: after deploying to staging, before promotion to production
- Pull Request: on ephemeral environments (preview deployments) for each PR
- Nightly scan: comprehensive scans scheduled every night on the staging environment
- Post-deploy: lightweight scan after each production deploy (passive scan only)
DAST: Advantages and Limitations
Advantages: low false positive rate, finds real runtime vulnerabilities, doesn't require source code access, tests infrastructure configuration. Limitations: slower than SAST, requires a running application, doesn't cover all code, may not find vulnerabilities in complex business logic.
OWASP ZAP: The Open Source Standard
OWASP ZAP (Zed Attack Proxy) is the most widely used open source DAST tool in the world, maintained by the OWASP Foundation. It's free, extensible, and supports both manual use (as an interception proxy) and automated use (for CI/CD pipelines).
ZAP Baseline Scan in Docker
The simplest way to run an automated DAST scan is using ZAP's official Docker containers:
# Baseline scan: quick scan, passive checks only
docker run --rm -t ghcr.io/zaproxy/zaproxy:stable \
zap-baseline.py \
-t https://staging.myapp.com \
-r zap-report.html \
-J zap-report.json \
-c zap-baseline.conf
# Full scan: complete scan with active scanning
docker run --rm -t ghcr.io/zaproxy/zaproxy:stable \
zap-full-scan.py \
-t https://staging.myapp.com \
-r zap-full-report.html \
-J zap-full-report.json
# API scan: specific for REST/GraphQL APIs
docker run --rm -t ghcr.io/zaproxy/zaproxy:stable \
zap-api-scan.py \
-t https://staging.myapp.com/api/openapi.json \
-f openapi \
-r zap-api-report.html
ZAP Configuration for CI/CD
To customize ZAP's behavior, a configuration file defines which rules to activate, severity thresholds, and exclusions:
# zap-baseline.conf
# Format: Rule_ID WARN|IGNORE|FAIL
# Passive scan rules
10010 WARN # Cookie No HttpOnly Flag
10011 WARN # Cookie Without Secure Flag
10015 FAIL # Incomplete or No Cache-control
10017 WARN # Cross-Domain JavaScript Source
10020 FAIL # X-Frame-Options Header
10021 FAIL # X-Content-Type-Options Header
10038 FAIL # Content Security Policy Header
10098 WARN # Cross-Domain Misconfiguration
10202 WARN # Absence of Anti-CSRF Tokens
90033 WARN # Loosely Scoped Cookie
GitHub Actions Integration
# .github/workflows/dast.yml
name: DAST Security Scan
on:
deployment_status:
jobs:
dast:
if: github.event.deployment_status.state == 'success'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: OWASP ZAP Baseline Scan
uses: zaproxy/action-baseline@v0.12.0
with:
target: