## DAST (Dynamic Application Security Testing)

Testing the running application from the outside (Black Box).
*   **Tool**: OWASP ZAP, Burp Suite Pro, Acunetix.
*   **Method**: Fuzzing. Throwing garbage at the app to see if it breaks.

### SAST vs DAST
*   **SAST (Static)**: Scans the Source Code (White Box). "You have a variable that isn't sanitized on line 40."
*   **DAST (Dynamic)**: Scans the URL. "I sent ' OR 1=1 and got a database error."