OAST (Out-of-band Application Security Testing)
Summary: PortSwigger's Dafydd Stuttard describes Out-of-band Application Security Testing (OAST) as combining the delivery mechanism of conventional DAST with the detective power of IAST: payloads are sent to a running application and, if handled unsafely, cause the application to make a network interaction, typically DNS, with an external system. He notes that Burp Collaborator was built to automate this, that OAST is language- and platform-agnostic unlike SAST and IAST, and that Acunetix and Netsparker are moving in the same direction.
What's compelling: OAST reports the precise vulnerability type and the input point that triggers it, and its payloads work whether the application is written in Java, .NET, PHP or anything else - while SAST and IAST tools must be largely rewritten and maintained for each language and platform they target.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026