Apr 29
Loading video player...
SAST analyzes source code without executing it, finding SQL injection, hardcoded credentials, buffer overflows, and weak cryptography before the code ever runs in production. This video covers where SAST fits in the SDLC, Semgrep command syntax and custom rule writing, Bandit for Python scanning, false positive triage, and the critical limitations that make DAST a necessary complement. The Heartbleed 2014 vulnerability is the case study for what SAST could catch. Watch the next video for DAST and IAST in practice. Chapters: 0:00 What SAST Actually Does 2:36 SAST in the SDLC: Shift Left Before It Ships 4:27 Semgrep: Rules, Patterns, and Custom Detection 6:26 Reading SAST Output: Triage and False Positive Handling 8:19 SAST Limitations and What It Cannot Catch 10:18 SAST for the PT0-003 Exam and the Real Lab 12:39 Quiz Time #SASTtutorial #Semgrepsecurityrules #staticapplicationsecuritytesting #PenTestPT0003 #shiftleftsecurity --- Disclosure The avatars and voices in this video are AI-generated. All content -- research, scripts, lesson design, and the custom video engine -- is created by a CISSP, CISM, and PMP certified professional with a Master's in Project Management, a B.S. in Information Technology, and a Doctorate in Business Administration in progress. This channel exists to make learning accessible and straightforward. CompTIA® and PenTest+® are registered trademarks of CompTIA, Inc. This channel is not affiliated with, endorsed by, or sponsored by CompTIA. All content is produced independently for educational purposes only. All penetration testing techniques shown are for authorized, legal use only — obtain written permission before testing any system you do not own. For official exam objectives, pricing, and policies visit comptia.org.