Web App Scanning

ScanSuite supports both authenticated and unauthenticated web scanning, using classic scanners, its own AI DAST engine, or the AI Pentest agent.

Running a web scan

1. 01
   Open the Dynamic Analysis tab
2. 02
   Enter the URLs

   A comma or newline separated list.

3. 03
   Select the engines you want
4. 04
   Check the Product / Eng ID

   This is what files the results under the right product.

5. 05
   Add authentication

   Cookies, a custom header, or both.

6. 06
   Submit

The engines

AI DAST

A black-box engine where the model chooses the attack point, the technique and the concrete payload values. The technique modules only shape the request flow and score the signal — there is no fixed payload catalog to replay.

1. 01
   Discover

   An internal crawler plus imported crawl records build the attack surface — visited URLs, forms, parameters — then deduplicate it into distinct attack points, so the same parameter is not tested eleven times under eleven URLs.

2. 02
   Profile

   A WAF detection pass tells the agent what it is up against and shapes payload encoding accordingly. An optional surface profiler widens the attack surface with endpoints the crawler could not reach.

3. 03
   Probe

   For each endpoint the model picks a technique module and the payload values to send. The module issues the requests and compares the payload response against the baseline.

4. 04
   Confirm

   Preliminary evidence goes to a second pass that issues its own follow-up requests and either confirms or denies. Signals that cannot be reproduced are discarded rather than shipped as informational.

5. 05
   Report

   Confirmed findings ship with severity, the payload list and the resolved HTTP exchange that produced them, then join the shared finding pipeline.

What the signal comparison looks at

Status-code change, a server error only in the payload response, a reflected payload marker, low body similarity or a length delta, error signatures, a redirect or final-URL change, or a timing delta of three seconds or more. Technique modules add family-specific boosts — SQL error signatures, template errors, command-injection timing, unescaped executable HTML for XSS, rendered-page inspection for stored XSS.

Technique coverage

SQL injection, SSRF, SSTI, XSS (reflected and stored), XXE, command injection, open redirect, path traversal, weak credentials, access control, and client-side and server-side families.

Distributed execution

ScanSuite uses distributed scanning workers. Each worker processes one scan job at a time, so multiple scans run in parallel and you scale by adding workers. See Setup parameters and services for the worker count.

Where results go

Most engines export to DefectDojo. Hidden Paths and Secrets results are not, given the nature of the data collected — download the Report from Scan History to review them.