What does static application security testing (SAST) offer as a tool to the testers?

Static Application Security Testing (SAST) is a white-box testing methodology that analyzes an application's source code, byte code, or binary code for security vulnerabilities. It does not require the application to be running. Therefore, a fundamental offering and requirement of SAST tools is access to the application's source code or its compiled form to perform a line-by-line or structural analysis for potential security flaws before the application is deployed.

A. Production system scanning is a characteristic of Dynamic Application Security Testing (DAST) or vulnerability scanning, not SAST, which analyzes code at rest.

B. Injection attempts are an active testing technique used by DAST tools on a running application to find vulnerabilities, which is contrary to SAST's static approach.

D. Live testing describes DAST, which interacts with a running application to identify vulnerabilities from the outside in, whereas SAST analyzes non-running code.

1. National Institute of Standards and Technology (NIST). (2017). NIST Special Publication 800-190: Application Container Security Guide. Section 3.1.2, Page 12. "Static Application Security Testing (SAST) tools examine source code or compiled versions of code to find security flaws."

2. Qin, S., & Li, G. (2019). A Survey on Static Application Security Testing (SAST) Tools. In 2019 IEEE 3rd Information Technology, Networking, Electronic and Automation Control Conference (ITNEC). Page 2436. DOI: 10.1109/ITNEC.2019.8729209. "SAST is a kind of white-box testing, which analyzes the source code of the application to find security vulnerabilities."