(Charles Rettig has been working as a DevSecOps engineer in an IT company that develops software and web applications for IoT devices. He integrated…

Out-of-Band Application Security Testing (OAST) is a technique used to detect vulnerabilities that are not discoverable through traditional request-and-response scanning methods. Burp Suite's implementation of OAST is the Burp Collaborator. It works by sending payloads that cause the target application to interact with a Burp-controlled server over an external channel (e.g., DNS, HTTP). These "invisible" or out-of-band interactions confirm vulnerabilities like blind SQL injection or blind SSRF with high confidence, which significantly minimizes false positives compared to inferential-based scanning techniques.

B. QAST is not a recognized standard acronym within the application security testing domain.

C. MAST stands for Mobile Application Security Testing, which is a broad category of testing focused on mobile apps, not a specific technology for finding invisible vulnerabilities.

D. NAST is not a recognized standard acronym within the application security testing domain.

1. PortSwigger. "What is OAST (out-of-band application security testing)?". Web Security Academy. PortSwigger. "OAST can be used to detect issues that are completely invisible in the application's responses, such as blind SQL injection." (Source: https://portswigger.net/web-security/oast).

2. PortSwigger. "Burp Collaborator". Burp Suite Documentation. PortSwigger. "Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities... by inducing a target application to interact with the Collaborator server." (Source: https://portswigger.net/burp/documentation/collaborator).