OWASP ZAP

What is DAST: probing a running app from outside to find weaknesses

DAST (dynamic application security testing) sends test requests to a running application from outside, without source code, to find vulnerabilities and misconfigurations. SAST reads code and SCA checks dependencies, so each looks in a different place. Use tools such as OWASP ZAP only on apps you own.