SAST & DAST Tools

Static and Dynamic Analysis Tools play a critical role in identifying security vulnerabilities in software development pipelines. Static Application Security Testing (SAST) analyzes source code without execution, catching issues like insecure dependencies, hardcoded secrets, and logic flaws early in the development lifecycle. Dynamic Application Security Testing (DAST) evaluates running applications to detect runtime vulnerabilities, such as insecure APIs or misconfigurations. Together, these tools form a layered defense strategy, ensuring security is embedded from code to deployment.

Static Application Security Testing (SAST) Tools¶

SAST tools analyze code at the source level, enabling early detection of vulnerabilities. They are typically integrated into CI/CD pipelines to enforce security standards during development.

Key SAST Tools¶

SonarQube
A widely used tool for code quality and security, supporting multiple languages. It identifies bugs, code smells, and security flaws.
Example command:
```
sonar-scanner -Dsonar.projectKey=myproject -Dsonar.sources=src
```
Fortify SCA
Focuses on secure coding practices and compliance with standards like OWASP Top 10.
Example command:
```
fortify-sca -project myproject -build mybuild
```
Checkmarx
Specializes in large-scale codebases and integrates with IDEs for real-time feedback.
Example command:
```
cxrun -project myproject -target mytarget
```
Semgrep
A lightweight, customizable tool for rule-based static analysis.
Example command:
```
semgrep --config=security_rules --json src/
```

Dynamic Application Security Testing (DAST) Tools¶

DAST tools simulate attacks on running applications to uncover vulnerabilities that may not be detectable via static analysis. They are often used in staging or production environments to validate security controls.

Key DAST Tools¶

OWASP ZAP
An open-source tool for automated web application testing. It identifies issues like XSS, SQL injection, and insecure endpoints.
Example command:
```
zap.sh -z zap-project.xml
```
Burp Suite
A commercial tool for manual and automated security testing, with advanced features for API and web application analysis.
Example command:
```
java -jar burpsuite_pro.jar -batch -input mytarget.com -output report.html
```
Nmap
A network discovery and vulnerability scanning tool, often used for infrastructure and service enumeration.
Example command:
```
nmap --script vuln mytarget.com
```
Acunetix
Focuses on web application security, with automated scanning for vulnerabilities like CSRF and broken authentication.
Example command:
```
acunetix -u https://mytarget.com -o report.xml
```

Integration Strategies¶

SAST in CI/CD Pipelines: Run SAST tools during code commits or pull requests to enforce security gates. For example, integrate SonarQube with GitHub Actions:

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: sonarsource/sonarqube-action@v2
        with:
          sonarqubeVersion: 9.9.1
          projectKey: myproject
          sources: src/

DAST in Pre-Deployment Stages: Use DAST tools to scan staging environments before production deployment. For example, schedule OWASP ZAP scans via Jenkins:
```
zap.sh -z zap-staging.xml -u https://staging.mytarget.com
```
Complementary Use: SAST identifies issues in code, while DAST validates runtime behavior. For instance, SAST may flag a hardcoded API key, while DAST confirms it is exposed in network traffic.

Key takeaways¶

SAST focuses on early-stage code analysis, catching vulnerabilities like insecure dependencies and logic flaws.
DAST evaluates running applications to detect runtime issues, such as misconfigured APIs or insecure endpoints.
Tools like SonarQube and OWASP ZAP are essential for integrating security into CI/CD pipelines and production environments.
Combining SAST and DAST ensures comprehensive coverage, reducing the risk of both static and dynamic vulnerabilities.
Automation of these tools in pipelines enables continuous security validation without disrupting development workflows.