Integration of DAST testing into secure web application development

Abstract

A series of runtime security assessments were conducted on institutional web applications by simulating real-world attacks using Dynamic Application Security Testing. The objective was to identify vulnerabilities during the testing phase of the Software Development Life Cycle, prior to implementation and security audits. To this end, a controlled testing environment was designed, and the specialized Open Web Application Security Project Zed Attack Proxy tool was selected and configured. Automated and manual scans were performed to detect common vulnerabilities, such as cross-site scripting and insecure configurations. During the tests, significant findings were identified, primarily related to errors in input validation and default configurations. The results were compared with current web security standards, enabling the establishment of appropriate mitigation and prevention measures. Overall, the integration of Dynamic Application Security Testing during the Software Development Life Cycle testing phase strengthened the ongoing security assurance of the evaluated systems by identifying runtime vulnerabilities before their deployment in production environments.