Web App Scanning

Scan running websites and web APIs, signed in or not, from the Dynamic Analysis page (Web App Scanning in the sidebar). You can run classic web scanners, the AI DAST engine, or the AI Pentest agent, which is what the form selects for a new user.

Before you start

See Teams and roles for allowed targets and who may change them, and AI providers and cost for the AI setup. Starting a scan needs the Operator or Team admin role.

Run a web scan

1. 01
   Open the form

   Select Web App Scanning in the sidebar. The page title reads Dynamic Analysis.

2. 02
   Choose the product

   Product / Eng ID, in the Schedule & Access section.

3. 03
   Enter the URLs

   In Specify the URLs under Target Scope, or select Fetch targets (the cloud button) to reuse the targets last scanned for this product. See Targets below for what is accepted.

4. 04
   Choose the scanners

   The form opens with Autonomous AI assessment on (the AI Pentest agent) unless you chose something else last time. To run classic scanners or AI DAST alone, switch Autonomous AI assessment off and switch on what you want under DAST Engine Settings. Specialized & API Scanning is collapsed: open it to see its scanners.

5. 05
   Add sign-in details (optional)

   Cookies (optional) and Custom header (optional), see Signing in below.

6. 06
   Leave Run or save on Run now

   Changing Frequency, Date or Time switches it to Save scan and schedules the scan instead, see Schedule the scan.

7. 07
   Select Start Analysis

   Scan submitted appears. The scan's page then opens; if the scan is waiting in the queue, Scan History opens instead and lists it.

zoom_inEnlarge

Check that it worked: the scan's page shows the status Queued or Started and the log begins to fill. Follow it there or in Scan History; a finished scan shows Finished.

If the scan does not start

The form

The scanner switches open as you left them: the form remembers the selection you last submitted, per person.

Targets

These rules apply to the targets of every web, API, infrastructure and AI Pentest scan, on the forms and in CI/CD and automation.

Each kind of allowed targets has one of three modes, set by a team admin:

Signing in

The cookies and headers you enter are sent by the classic scanners, AI DAST and AI Pentest, so the signed-in part of the application is tested too.

The scanners

See Custom Rules for writing your own rules.

AI DAST

AI DAST crawls the application, tests what it finds for the vulnerability classes below, and reports only findings it has confirmed with a working request. Every finding is re-tested before it is reported, and comes with the URL, the parameter, the payload that proved it, the HTTP exchange and how to fix it.

zoom_inEnlarge

What AI DAST tests for

• SQL injection, command injection, server-side template injection (SSTI), XML external entities (XXE) and server-side request forgery (SSRF)
• Reflected and stored cross-site scripting (XSS)
• Open redirect and path traversal
• Information disclosure
• Default and common credentials on every login form it finds, reported as High. Credentials marked Use in AI scans on the Credentials page (the product's and the team-wide ones) are tried as well.
• Vulnerable client-side JavaScript libraries, with the CVE and the severity from the library's advisory

Further classes are experimental and are not run from the console.

What to expect

• Requests it sends. AI DAST uses GET, POST, HEAD and OPTIONS, never PUT, PATCH or DELETE. It does submit forms, for example to test stored XSS and login forms, so test entries can appear in the application and repeated failed logins can lock an account.
• Without an AI answer. If the AI provider does not answer, AI DAST still runs a built-in set of checks, with lower coverage.
• Limits per URL. Each URL is tested with at most 800 requests, 200 AI calls and one hour. A run that hits a limit says so in the log, for example AI DAST stopped before it covered the target: the request budget (800 requests) was used up, followed by the findings it confirmed and the advice to narrow the target. Such a run counts as not completed; give a narrower URL, such as one section of the application, to test the rest.
• Cost. AI DAST spends AI tokens; the scan page and Scan History show how many.

Several URLs and scanners

The scanners and URLs of one scan run in parallel. An administrator can add workers so that more scans run at once, see Setup parameters and services.

When a scan is incomplete

A scanner that is not set up (Acunetix, Nessus Web) is skipped with a Scanner skipped warning in the log, and a URL that does not answer is a warning, not a failure. An engine whose scanner images this server lacks is marked Not installed on this server. on the form and cannot be chosen. What each outcome means and what to do is listed in Managing scan execution.

From a pipeline or a terminal

The same scan runs without the console through scansuite-ci and a team API token:

scansuite-ci --scan-type dast --target https://staging.example.com \
  --profile standard --header "Authorization: Bearer $STAGING_TOKEN"

--profile takes quick, standard (the default) or deep; --scanners names them instead, for example --scanners mldast for AI DAST alone. The command waits for the scan and exits 0 when it passes the quality gate. See CI/CD and automation.

Where results go

• AI DAST, AI Pentest, Nessus Web and Custom Rules always record their findings on the Vulnerabilities page.
• The classic scanners (Quick, Balanced, Deep Scan, API Scan, Nuclei, Acunetix) record their findings there too, at Medium severity and above, unless the team changes it: Teams, Scanning tab, Scanner findings in Vulnerabilities card, Store scanner findings (On by default) and Lowest severity to store (Medium by default). Close findings a rescan no longer reports in the same card decides whether a rescan closes them; see Vulnerability Management.
• Everything is in the scan's Report in Scan History and, when the team has DefectDojo connected, in DefectDojo (see Set up DefectDojo). Hidden Paths, Secrets and Tech Discovery are never exported to DefectDojo; download the Report to review them.