SAST vs DAST

SAST (Static Application Security Testing) vs DAST (Dynamic Application Security Testing)

• SAST is a White box security testing while DAST is a Black box security testing
• SAST analyzes source code or binaries. While, DAST doesn't require source code and test is carried out with running application.
• SAST finds vulnerabilities earlier in SDLC (Software Development Life Cycle) while DAST finds vulnerabilities towards the end.
• Vulnerabilities found with SAST are less expensive to fix as the application is not yet finished. While, it is expensive to fix vulnerabilities found with DAST as application is almost complete. 
• The drawback with SAST is that it cannot discover runtime and environment related vulnerabilities wile DAST is able to find such issues.
• SAST tool supports all kinds of software while DAST only scan apps like web application and web services.

Black Box vs White Box Test

BlackBox Security Testing

• The tester has no knowledge of the technology or frameworks that the application is built on.
• The application is tested from outside in.
• This type of testing represents the hacker approach.
• This, in one sense, could be called as reverse engineering.

WhiteBox Security Testing

• The tester has access to the underlying framework, design and implementation.
• The application is tested from the inside out.
• This type of testing represents the developer approach.