Run SAST and DAST on your own app and map the blind spots

short · 55 min · Objective 3.1

Task

Run static and dynamic analysis against a small application you wrote, and show for yourself what each finds and each structurally misses — because SAST reads the code without running it, DAST runs the application without reading it, and neither reliably finds a logic flaw.

Steps

  1. Write a small application with three planted issues: an input reaching a dangerous operation (SAST should flag it), a configuration weakness only present at deployment (DAST territory), and a logic flaw (neither should catch).
  2. Run a SAST tool over the source and save findings to /tmp/sast.txt.
  3. Run a DAST tool against the running instance on the lab you own and save to /tmp/dast.txt.
  4. Confirm SAST found the code-level issue and flagged some false positives — it errs toward reporting because it sees code, not context.
  5. Confirm DAST found the deployment issue and did not need the source.
  6. Confirm neither found the logic flaw, and write down why each was blind to it.

Verify

grep -ciE "inject|taint|dangerous|line [0-9]" /tmp/sast.txt
grep -ciE "header|config|tls|cookie|deployed" /tmp/dast.txt
grep -ciE "logic|neither|blind|business rule" /tmp/blindspots.md

The first count must be non-zero: SAST flagged the code-level issue. The second must be non-zero: DAST found something in the deployed reality that SAST could not see in the source. The third must be non-zero: you wrote why both were blind to the logic flaw — SAST cannot judge intent, DAST never triggered the specific path, and neither has a pattern for the application correctly doing the wrong thing.

Notes

SAST belongs early in a pipeline where a developer sees the result while the code is fresh, and its cost is developer attention — a gate with a high false-positive rate gets disabled, and a disabled gate is worse than none. DAST belongs against a deployed environment. "We run both and they're clean" is not a complete answer, and being able to say why precisely is worth more to a client than another finding. All analysis here ran on your own code.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.