Penetration testing and DAST are two ways of attacking a running app on purpose, to find its security holes before an attacker does. DAST stands for dynamic application security testing. It is software that sends attacks to the app while the app is running. Penetration testing, or pentesting, is the same work done by skilled human testers, who think like attackers. Many companies now buy it as penetration testing as a service (PTaaS), with the testers, the scanner and the report on one online platform. Both are methods of offensive security testing.
Most modern apps are a screen on the phone and an API behind it. Here, the API is the set of requests that the phone app sends to the company's servers, such as "show booking 10234". The app's screens hide a lot. The API often accepts requests that the screens never send. So most testing now attacks the API directly.
Consider a bus ticket booking company in Bengaluru. Its app shows each passenger only their own bookings. First, a DAST tool reads the description of the API and sends thousands of altered requests. It tries very long inputs, special characters and missing fields. It checks whether any reply contains an error message or data that should be hidden.
Then a human tester logs in with a test account that owns booking 10234. She sends the same request with the number changed to 10235. The server returns another passenger's name, phone number and seat. The server had checked that the tester was logged in. It had not checked that the booking belonged to her. This flaw is called broken object-level authorisation, and it is one of the most common API flaws. The tester then writes a short script that tries 1,000 booking numbers in a row, and every one of them works. So the flaw could have exposed every passenger's details.
The report rates the flaw as critical and explains how to repeat it. The developers add one check on the server: does this booking belong to this account? The tester sends the same request again, and the server now refuses it.
DAST and human testers find different things. DAST is fast and can run after every change, but it finds only known kinds of mistakes. A human tester also finds flaws in the app's logic, such as this one. The findings go to application security posture management (ASPM), which joins them with the code scanners' findings into one list. After release, the API is protected while it runs by API security products.
DAST is different from static application security testing (SAST). SAST reads the source code without running it. DAST attacks the running app from the outside, as an attacker would.