Static Application Security Testing

What Is Static Application Security Testing?

Static Application Security Testing (SAST) is a type of software security testing that is performed by analyzing the source code of an application. It is a form of white box testing, meaning that the tester has access to the source code and can analyze it for potential security vulnerabilities. SAST is typically used to detect coding errors, such as buffer overflows, SQL injection, and cross-site scripting. It is also used to identify insecure coding practices, such as hard-coded passwords, and to detect potential security flaws in the application architecture. SAST is typically performed by automated tools that can scan the source code and detect potential security issues.

Description

Static Application Security Testing (SAST) is a type of software security testing that is performed by analyzing the source code of an application.

Usage and Examples

SAST is typically used to detect coding errors, such as buffer overflows, SQL injection, and cross-site scripting. It is also used to identify insecure coding practices, such as hard-coded passwords, and to detect potential security flaws in the application architecture. SAST is typically performed by automated tools that can scan the source code and detect potential security issues. For example, a SAST tool may detect a buffer overflow vulnerability in a web application by analyzing the source code for a function that copies data into a fixed-size buffer without checking the size of the data.