> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/dynamic-application-security-testing.md).

# Dynamic Application Security Testing - DAST

Dynamic Application Security Testing (DAST) is a security testing practice that identifies vulnerabilities in running applications by simulating real-world attacks. It is an essential part of the security testing process to discover issues that may arise during runtime, such as input validation flaws, authentication errors, and configuration vulnerabilities.

With Harness Security Testing Orchestration (STO), you can seamlessly perform DAST using a wide range of [integrated scanners](#supported-scanners-for-dast). STO enhances the scanning process by normalizing results, deduplicating findings, and formatting them into actionable insights.

### Set up DAST Scanning with Harness STO <a href="#set-up-dast-scanning-with-harness-sto" id="set-up-dast-scanning-with-harness-sto"></a>

You can use any of the [integrated scanners](#supported-scanners-for-dast) that perform DAST scanning, or you can leverage the Harness STO [Built-in Scanner workflow](/security-testing-orchestration/use-sto/set-up-sto-scans/built-in-scanners.md). The Built-in Scanner step enables you to set up scans without requiring paid licenses or complex configurations. Currently, the Built-in Scanner uses [Zed Attack Proxy (ZAP)](/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/zap/dast-scan-zap.md). Alternatively, you can select any of the supported scanners below for detailed configuration steps.

#### Supported Scanners for DAST <a href="#supported-scanners-for-dast" id="supported-scanners-for-dast"></a>

Below is the list of scanners supported for DAST in Harness STO:

If the scanner you use for DAST scanning is not listed, you can explore additional [scanners](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) that are compatible with the [Custom Scan step](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md). If the Custom Scan step does not support the scanner you need, you can use the [Custom Ingestion](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-ingest-reference.md) step to ingest and process your scan results.

### Next steps <a href="#next-steps" id="next-steps"></a>