AppSecNews

DAST

Dynamic Application Security Testing

Probe a running application from the outside, the way an attacker would.

34 tools profiled

How it differs Tests the running application from the outside, with no access to source. SAST never runs the app; IAST instruments it from the inside.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

4 tools match

Active Manual Testing Clear all

  • Burp Suite

    PortSwigger

    DAST

    Intercepting proxy and testing toolkit that puts a human in the request path, with an automated scanner and an extension ecosystem around it.

    Freemium
    Established Verified

  • Caido

    Caido Labs

    DAST

    Web security testing proxy built around a separate client and server, with a query language for filtering traffic and a plugin system for automation.

    Not recorded
    Growing

  • Fluid Attacks

    Fluid Attacks

    DAST

    Continuous security testing service combining automated scanners with a standing team of testers, delivered through a shared platform with a build gate.

    Commercial
    Growing

  • ZAP

    ZAP project, Software Security Project

    DAST

    Open source intercepting proxy and scanner that passively analyzes proxied traffic and actively attacks discovered endpoints, scriptable end to end.

    Open source
    Established Verified

  • Burp Suite

    PortSwigger

    Intercepting proxy and testing toolkit that puts a human in the request path, with an automated scanner and an extension ecosystem around it.

    Freemium Established
    DAST

  • Caido

    Caido Labs

    Web security testing proxy built around a separate client and server, with a query language for filtering traffic and a plugin system for automation.

    Not recorded Growing
    DAST

  • Fluid Attacks

    Fluid Attacks

    Continuous security testing service combining automated scanners with a standing team of testers, delivered through a shared platform with a build gate.

    Commercial Growing
    DAST

  • ZAP

    ZAP project, Software Security Project

    Open source intercepting proxy and scanner that passively analyzes proxied traffic and actively attacks discovered endpoints, scriptable end to end.

    Open source Established
    DAST
Tick up to 4 tools above.