Secure › Module 8 › Lesson 1
DAST Named
Dynamic analysis hits running apps — concept on YOUR local lab URL only.
Visual · t17_dast_named
DAST = probe running app like a client would. Original Cyberlium.
Opening
DAST finds the hole your unit tests never visited — but only on servers you are allowed to hammer.
Dynamic Application Security Testing sends HTTP requests to a live app to find XSS, misconfig headers, cookie issues, and exposed endpoints. Tools include OWASP ZAP and Burp Scanner modes — used against YOUR lab instance on localhost or $LAB_URL you deploy. DAST is noisy and needs scope rules. Never aim DAST at employer production, school portals, SaaS you do not own, or 'just checking' public sites — that is unauthorized testing. Pair DAST findings with SAST and manual review on $REPO.
1. SAST vs DAST
SAST: source without running. DAST: HTTP to running build with routes and config live.
DAST catches deployment mistakes SAST misses — wrong headers, debug endpoints enabled.
Command guide
Try these commands — SAST vs DAST
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"Primary tools to practice this lesson: curl, python3. Reference sites: DAST overview (https://owasp.org/www-project-web-security-testing-guide/); OWASP ZAP (https://www.zaproxy.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Tool literacy
ZAP baseline scan for CI smoke; authenticated scan needs test creds you created in lab.
Scope URL must match RoE — single host/path prefix.
3. Ethics
Target $LAB_URL or localhost only in course labs.
Written authorization required for any non-owned environment — default is refuse.
4. What you ship: DAST vocabulary
DAST definition + SAST contrast + $LAB_URL-only scope.
5. What you record before the next lesson
DAST named paragraph.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run ZAP active scan against university login portal.
Right
Name DAST vs SAST. Next: lab-only DAST.
Mission: DAST literacy notes
1) Define DAST in one sentence. 2) Contrast with SAST. 3) Write NEVER DAST stranger production.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “ZAP baseline vs full scan?”
Knowledge Check
APPLY: DAST requires:
Multiple choice
Knowledge Check
APPLY: True or False: DAST on stranger SaaS is homework.
True or False
Knowledge Check
APPLY: DAST may find:
Multiple choice