What is DAST in application security?

DAST (Dynamic Application Security Testing) probes a running application from the outside — sending crafted HTTP requests to discover injection flaws, authentication bypasses, access-control failures, and other runtime vulnerabilities without access to source code.

What vulnerability classes does Pencheff DAST cover?

Pencheff DAST covers all OWASP Top 10 (2021) classes: injection (SQLi, NoSQLi, command injection, SSTI, XXE, SSRF, LDAP), broken access control, authentication failures, XSS (reflected, stored, DOM), CSRF, insecure deserialization, and security misconfiguration.

How does Pencheff verify DAST findings before reporting them?

Every candidate finding is re-fired with a confirmatory payload and the response is inspected for conclusive evidence of exploitation. Findings without verifiable evidence are discarded rather than reported as 'potential' issues.

Can Pencheff DAST test authenticated web applications?

Yes. Pencheff records a login macro and replays it to maintain an authenticated session throughout the scan. It also handles OAuth flows, MFA, and cookie-based sessions for authenticated coverage of protected endpoints.

Runtime DAST

Web DAST

Authenticated crawling, API discovery, active probes, exploit chains, and request evidence.

Start free Sign in

ScopeSecurity Surfaces

Run web, API, code, dependency, cloud, AI, and internal-network assessments from one queue with unified findings, evidence, remediation, and audit output.

OutputUnified evidence

Findings, reports, dashboards, exports, integrations, and retests all read from the same normalized record.

MethodDeterministic first

Pencheff favors repeatable checks, then uses AI for triage, enrichment, orchestration, and remediation where it adds signal.

Coverage

What does Web DAST test?

Authenticated crawling, API discovery, active probes, exploit chains, and request evidence.
This page is part of Platform under Security Surfaces.
It links back into the broader a complete adversarial security platform experience.
Passive and active reconnaissance, technology fingerprinting, endpoint inventory, and crawl expansion.
Authenticated crawling for SPAs, role-aware flows, cookies, headers, JWTs, OAuth/OIDC, and MFA-sensitive areas.
Injection coverage for SQL, NoSQL, command, SSTI, XXE, SSRF, LDAP, deserialization, path traversal, and file upload abuse.
Client-side and protocol checks for XSS, DOM XSS, CSRF, CORS, clickjacking, cache poisoning, redirects, headers, WebSockets, and GraphQL.
Verification probes that promote high-confidence results into replayable findings with request and response context.

Execution

How does Pencheff run this?

Create a URL or API target with scope, auth material, allowed hosts, and rate limits.
Map the surface with recon, crawl, endpoint discovery, and optional OpenAPI or traffic-derived routes.
Run profile-controlled checks from quick validation through deep exploit-chain analysis.
Re-test candidate issues with focused probes before they become confirmed findings.
Attach evidence, severity, remediation, and compliance mappings to the unified findings stream.

Evidence

What evidence does this produce?

HTTP request and response excerpts, affected URL, parameter, method, status code, and payload family.
OAST callbacks, browser screenshots, chain notes, and exact reproduction steps where applicable.
Authentication context, role assumptions, session notes, and guardrails used during assessment.
OWASP, CWE, PCI DSS, SOC 2, ISO 27001, NIST, and HIPAA mappings for audit readers.

Controls

How is this kept safe to run?

Scope allow-lists, profile depth, time budgets, and evidence requirements bound active testing.
State-changing and destructive behavior can be constrained by target policy and profile selection.
Findings are deduplicated against existing scan history and can be re-examined on demand.
Authenticated material is scoped to the target and treated as assessment-only input.

Documentation

Read the full reference.

References

Authoritative sources

FAQ

Common questions

What is DAST in application security?: DAST (Dynamic Application Security Testing) probes a running application from the outside — sending crafted HTTP requests to discover injection flaws, authentication bypasses, access-control failures, and other runtime vulnerabilities without access to source code.
What vulnerability classes does Pencheff DAST cover?: Pencheff DAST covers all OWASP Top 10 (2021) classes: injection (SQLi, NoSQLi, command injection, SSTI, XXE, SSRF, LDAP), broken access control, authentication failures, XSS (reflected, stored, DOM), CSRF, insecure deserialization, and security misconfiguration.
How does Pencheff verify DAST findings before reporting them?: Every candidate finding is re-fired with a confirmatory payload and the response is inspected for conclusive evidence of exploitation. Findings without verifiable evidence are discarded rather than reported as 'potential' issues.
Can Pencheff DAST test authenticated web applications?: Yes. Pencheff records a login macro and replays it to maintain an authenticated session throughout the scan. It also handles OAuth flows, MFA, and cookie-based sessions for authenticated coverage of protected endpoints.