Static application security testing: Difference between revisions

Revision as of 06:19, 23 September 2024

Revision as of 09:56, 20 February 2025

Line 1:

{{Short description|Software securing application}}

'''Static application security testing''' ('''SAST''') is used to secure software by reviewing the source code of the software to identify sources of vulnerabilities. Although the process of [[StaticInformal programmethods analysisof validation and verification#Desk checking|staticallychecking analyzingprograms theby sourcereading their code ]] has(modernly existedknown as long[[Static asprogram computersanalysis|static haveprogram existed{{Clarify|reason=Earlyanalysis]]) computershas existed beforeas sourcelong code,as thiscomputers ishave too vague.|date=September 2024}}existed, the technique spread to security in the late 90s and the first public discussion of [[SQL injection]] in 1998 when Web applications integrated new technologies like [[JavaScript]] and [[Adobe Flash Player|Flash]].

Unlike [[dynamic application security testing]] (DAST) tools for [[black-box testing]] of application functionality, SAST tools focus on the code content of the application, [[white-box testing]].