hat type of vulnerabilities cannot be identified by SAST Scanning?Cross Site ScriptingSQL InjectionBusiness LogicServer Side Request forgeryReset Answer

Business Logic vulnerabilities cannot be identified by SAST (Static Application Security Testing) Scanning. This is because SAST tools are designed to analyze the source code of an application to find security vulnerabilities. They are very effective at identifying issues like Cross Site Scripting, SQL Injection, and Server Side Request forgery, which are all related to the way the code is written.

However, Business Logic vulnerabilities are different. They are not about the code itself, but about the way the application works. They involve scenarios where an attacker can use the legitimate processing flow of an application in a way that was not intended by the developers. Because these vulnerabilities are about the logic of the application rather than the code, they cannot be identified by analyzing the code with SAST tools.