Static
Dynamic
Application Security Testing
Static means it does not need the application to run but dynamic means needs the application to run.
White box testing:- also known as clear box testing, happens when you have insight into the code and/or general knowledge about the architecture of the software in question.
Black box testing:- is when you have no idea how the software you are testing was programmed.
Examples of threats:- SQLinjection, Bruteforce, DDoS
SAST:- it is a white box method of testing. It examines the code to find software flaws and weakness such as SQL injection.
DAST:- (at run time of application) It is a black box method of testing. It examines an application as it is running to find vulnerabilities that an attacker could exploit.
Major Differences between SAST and DAST:
|
SAST |
DAST |
|
White box |
Black box |
|
Developer Approach |
Hacker Approach |
|
Tester has access to source code and has knowledge of the
technologies/frameworks that app is built on. |
Tester has no knowledge of the technologies/frameworks that
app is built on. |
|
Requires only source code or binary |
Requires the app to run and executed |
|
Vulnerabilities are detected earlier in the SDLC as the code
scan can be executed as soon as the code is deemed feature-complete. |
Vulnerabiltiies are detected only towards the end of the SDLC. |
|
Less expenses need to be utilitised to fix the vulnerabilities. |
More expenses need to be utilised to fix the vulnerabilities. |
|
Cannot discover run time and environment related issues. |
Used to find run time and environment issues. |
