# Web App Scanning

> Scan websites and web APIs, signed in or not, with classic scanners, AI DAST or the AI Pentest agent; the target rules for every scan.

Source: https://scansuite.eu/documentation/usage/web-app-scanning
Last reviewed: 2026-10-19

Scan running websites and web APIs, signed in or not, from the **Dynamic Analysis** page (**Web App Scanning** in the sidebar). You can run classic web scanners, the AI DAST engine, or the [AI Pentest agent](https://scansuite.eu/documentation/usage/ai-pentest), which is what the form selects for a new user.

> **Best practice:** Create separate products for different scan types, or group websites by category. This makes result analysis and reporting far simpler later on.

## Before you start

| You need | Where it is set | How to check |
|---|---|---|
| The URLs are allowed for your team | Teams in the sidebar, Scanning tab, Web targets card. A new team allows nothing until a team admin adds hosts. | In the same card, open Check whether targets are allowed, paste the URLs and select Check: each must be reported as allowed. |
| An AI provider, for AI DAST and AI Pentest | Teams, AI tab (or the system AI a system administrator sets up). See AI providers. | From a terminal: scansuite-ci --scan-type dast --list-scanners. mldast and ai_pentest must not say NOT AVAILABLE. |
| Acunetix, only if you use it | Teams, Scanning tab, Scanner engines card. | The Acunetix block shows a connected badge. |
| Nessus Web, only if you use it | The shared Nessus a system administrator sets up in System Settings. | The number of runs left appears next to Nessus Web on the form. |
| A product | Products page. The scan files its results under it. | It is listed under Product / Eng ID on the form. |

See [Teams and roles](https://scansuite.eu/documentation/administration/teams-and-roles) for allowed targets and who may change them, and [AI providers and cost](https://scansuite.eu/documentation/usage/ai-providers) for the AI setup. Starting a scan needs the Operator or Team admin role.

## Run a web scan

1. **Open the form**

   Select Web App Scanning in the sidebar. The page title reads Dynamic Analysis.
2. **Choose the product**

   Product / Eng ID, in the Schedule & Access section.
3. **Enter the URLs**

   In Specify the URLs under Target Scope, or select Fetch targets (the cloud button) to reuse the targets last scanned for this product. See Targets below for what is accepted.
4. **Choose the scanners**

   The form opens with Autonomous AI assessment on (the AI Pentest agent) unless you chose something else last time. To run classic scanners or AI DAST alone, switch Autonomous AI assessment off and switch on what you want under DAST Engine Settings. Specialized & API Scanning is collapsed: open it to see its scanners.
5. **Add sign-in details (optional)**

   Cookies (optional) and Custom header (optional), see Signing in below.
6. **Leave Run or save on Run now**

   Changing Frequency, Date or Time switches it to Save scan and schedules the scan instead, see Schedule the scan.
7. **Select Start Analysis**

   Scan submitted appears. The scan's page then opens; if the scan is waiting in the queue, Scan History opens instead and lists it.

![ScanSuite dynamic scan configuration](https://scansuite.eu/static/assets/img/docs/usage/web-app-scanning/01.png)

*The Dynamic Analysis page*

**Check that it worked:** the scan's page shows the status Queued or Started and the log begins to fill. Follow it there or in [Scan History](https://scansuite.eu/documentation/usage/managing-scan-execution); a finished scan shows Finished.

### If the scan does not start

| Message | What to do |
|---|---|
| No valid URLs provided: … is not accepted (…) | No URL passed the input check. The message names up to three refused URLs and why, for example give the URL without a query string. Fix them as in Targets below. |
| Target is not allowed by the team target policy | A URL is outside the team's web targets. Ask a team admin to add it, or remove it. |
| Invalid headers format. Try Header: Value Multiple headers separated by \| | The custom header has no colon, or contains a comma or semicolon. See Signing in. |
| Invalid cookies format. Try Key=Value Multiple cookies separated by ; | The cookie text has no =. |
| Chosen scanners are not allowed in this version | No scanner is switched on, or a scanner your edition does not include. |
| Another message under the form | ScanSuite refused to start the scan and says why, for example that the team is already running its limit of concurrent scans (wait for one to finish), or that the web targets are set to Only the targets listed below, also checked while the scan runs while a scanner other than AI DAST is on. |
| The scan could not be submitted. The system logs have the reason. | The worker failed to take the scan. An administrator finds the reason on the server with ./scansuite logs web and ./scansuite logs worker. |

## The form

| Field | What it does | Default | When to change it |
|---|---|---|---|
| Saved Scans | Loads a scan you saved or scheduled, to change or re-save it. Lists only your own saved scans. | New | To edit a schedule, see Schedule the scan. |
| Delete saved scan (bin) | Deletes the saved scan selected in Saved Scans. | – | To remove a schedule. |
| Specify the URLs | The websites or API specifications to scan. | Empty | Always. |
| Fetch targets (cloud button) | Fills the URLs with the targets this product was last scanned with. Without any it says Targets not found. Run OSINT scan for this product. Every scan you submit replaces the product's stored targets. | – | To rescan the same URLs. |
| Instructions (optional) | Guidance for the AI Pentest agent. Shown only while Autonomous AI assessment is on; every other scanner ignores it. | Empty | See AI Pentest. |
| Frequency, Date, Run or save, Time | Run now, or save the scan to run once later or repeatedly. | Once, Run now | See Schedule the scan. |
| Product / Eng ID | The product the results are filed under. | The newest product | Always check it. |
| Cookies (optional) | Session cookies sent with every request, name=value, several separated by ;. | Empty | To scan behind a login. |
| Custom header (optional) | Request headers sent with every request, such as Authorization. | Empty | To scan behind a login or an API key. |
| DAST Engine Settings, AI Pentest | The scanner switches, see The scanners. | Autonomous AI assessment on, everything else off | To choose what runs. |

The scanner switches open as you left them: the form remembers the selection you last submitted, per person.

## Targets

These rules apply to the targets of every web, API, infrastructure and AI Pentest scan, on the forms and in [CI/CD and automation](https://scansuite.eu/documentation/reference/cicd).

| Rule | What happens |
|---|---|
| Separators | Comma, semicolon or a new line. Spaces are removed. |
| Web targets | A URL such as https://app.example.com/shop. A URL without a scheme gets https://. |
| Infrastructure targets | An IP address (10.20.30.40), a range (10.20.40.40-45), a network (10.20.50.0/24) or a host name (example.com). |
| Accepted characters | Only letters, digits and : . _ / -. A URL with a query string (?a=b) or a fragment (#) is refused: give the URL without it. |
| Duplicates | Dropped. |
| A refused target next to accepted ones | Dropped without a message; the scan starts with the rest. Check the Targets card on the scan's page. |
| Every target refused | The scan does not start. The message names up to three refused targets and the reason. |
| Allowed targets | Every target must match the team's Web targets or Infrastructure targets (Teams, Scanning tab). A container image is checked against the registry it comes from, see Infrastructure Checks. |

Each kind of allowed targets has one of three modes, set by a team admin:

| Allow | Effect on scans |
|---|---|
| Only the targets listed below | Targets are checked when the scan starts. Every scanner can run. |
| Only the targets listed below, also checked while the scan runs | Web scans: every request and redirect is checked as well, and only AI DAST can do that, so every other scanner, AI Pentest included, is refused. To scan in this mode, switch Autonomous AI assessment off and switch AI DAST on. Infrastructure scans are all refused in this mode. |
| Any target | No check. |

## Signing in

The cookies and headers you enter are sent by the classic scanners, AI DAST and AI Pentest, so the signed-in part of the application is tested too.

| Field | Format |
|---|---|
| Cookies (optional) | name=value. Separate several with a semicolon (a comma also works): session=abc123; theme=dark. Spaces are removed. |
| Custom header (optional) | Name: value. Separate several with \|: Authorization: Bearer eyJ…\|X-Tenant: demo. A header whose value contains a comma or a semicolon is refused, so such a header cannot be sent. |

> **Warning:** A signed-in scan acts as that user: it submits forms and follows links a person in that session could. Use a test account, not a real person's session, and expect test data to appear in the application.

## The scanners

| Scanner | Group on the form | What it does |
|---|---|---|
| Quick | Web Scanning (DAST) | Fast web checks (ZAP baseline and Dastardly), sized for CI/CD smoke testing. |
| Balanced | Web Scanning (DAST) | Broader coverage for routine web scans (Arachni and Wapiti). |
| Nuclei | Web Scanning (DAST) | Template-based checks for known web exposures. |
| Acunetix | Web Scanning (DAST) | Commercial web application scanner. Needs Acunetix in the team's Scanner engines card. |
| Nessus Web | Web Scanning (DAST) | Commercial web vulnerability scanner on the shared Nessus. The runs left are shown next to its name. |
| Tech Discovery | Specialized & API Scanning | Fingerprints frameworks, stacks and versions. |
| Hidden Paths | Specialized & API Scanning | Finds unlinked content and exposed directories. |
| Secrets | Specialized & API Scanning | Crawls pages for leaked keys and tokens. |
| Custom Rules | Specialized & API Scanning | Your own Nuclei templates from the Rules page. Under the switch the form says how many rules will run for the chosen product, and Only these packs: narrows them to some packs. With no active rule it says the scanner will be skipped. |
| Deep Scan | Specialized & API Scanning | Comprehensive crawling and intrusive testing (ZAP full scan, up to two hours). |
| API Scan | Specialized & API Scanning | Tests an API from its OpenAPI specification, see Web API scans. |
| Autonomous AI assessment | AI Pentest | The AI Pentest agent. On by default. While it is on, the other scanners do not run on their own: the agent uses what it needs. |
| AI DAST | AI Pentest | ScanSuite's AI web scanner, described below. Switched off and greyed out while Autonomous AI assessment is on. |

> **Note:** AI DAST is part of AI Pentest, so the form switches it off while Autonomous AI assessment is on and says: AI Pentest already includes AI DAST coverage. To run AI DAST alone, switch Autonomous AI assessment off first.

> **Note:** Quick, Balanced and Deep Scan first check for a web application firewall. If one is detected, Balanced and Deep Scan are skipped and Quick leaves out Dastardly.

See [Custom Rules](https://scansuite.eu/documentation/usage/custom-rules) for writing your own rules.

## AI DAST

AI DAST crawls the application, tests what it finds for the vulnerability classes below, and reports only findings it has confirmed with a working request. Every finding is re-tested before it is reported, and comes with the URL, the parameter, the payload that proved it, the HTTP exchange and how to fix it.

![ScanSuite AI DAST selected, with Autonomous AI assessment off](https://scansuite.eu/static/assets/img/docs/usage/web-app-scanning/02.png)

*AI DAST selected, with Autonomous AI assessment off*

### What AI DAST tests for

- SQL injection, command injection, server-side template injection (SSTI), XML external entities (XXE) and server-side request forgery (SSRF)
- Reflected and stored cross-site scripting (XSS)
- Open redirect and path traversal
- Information disclosure
- Default and common credentials on every login form it finds, reported as High. Credentials marked **Use in AI scans** on the [Credentials](https://scansuite.eu/documentation/usage/credentials) page (the product's and the team-wide ones) are tried as well.
- Vulnerable client-side JavaScript libraries, with the CVE and the severity from the library's advisory

Further classes are experimental and are not run from the console.

### What to expect

- **Requests it sends.** AI DAST uses GET, POST, HEAD and OPTIONS, never PUT, PATCH or DELETE. It does submit forms, for example to test stored XSS and login forms, so test entries can appear in the application and repeated failed logins can lock an account.
- **Without an AI answer.** If the AI provider does not answer, AI DAST still runs a built-in set of checks, with lower coverage.
- **Limits per URL.** Each URL is tested with at most 800 requests, 200 AI calls and one hour. A run that hits a limit says so in the log, for example *AI DAST stopped before it covered the target: the request budget (800 requests) was used up*, followed by the findings it confirmed and the advice to narrow the target. Such a run counts as not completed; give a narrower URL, such as one section of the application, to test the rest.
- **Cost.** AI DAST spends AI tokens; the scan page and Scan History show how many.

> **Warning:** An intrusive test can still affect a live system. Scan a staging copy where you can.

## Several URLs and scanners

The scanners and URLs of one scan run in parallel. An administrator can add workers so that more scans run at once, see [Setup parameters and services](https://scansuite.eu/documentation/administration/setup-parameters-and-services).

## When a scan is incomplete

A scanner that is not set up (Acunetix, Nessus Web) is skipped with a *Scanner skipped* warning in the log, and a URL that does not answer is a warning, not a failure. An engine whose scanner images this server lacks is marked *Not installed on this server.* on the form and cannot be chosen. What each outcome means and what to do is listed in [Managing scan execution](https://scansuite.eu/documentation/usage/managing-scan-execution).

## From a pipeline or a terminal

The same scan runs without the console through `scansuite-ci` and a team API token:

*A DAST scan of a staging deployment*

```
scansuite-ci --scan-type dast --target https://staging.example.com \
  --profile standard --header "Authorization: Bearer $STAGING_TOKEN"
```

`--profile` takes `quick`, `standard` (the default) or `deep`; `--scanners` names them instead, for example `--scanners mldast` for AI DAST alone. The command waits for the scan and exits 0 when it passes the quality gate. See [CI/CD and automation](https://scansuite.eu/documentation/reference/cicd).

## Where results go

- **AI DAST, AI Pentest, Nessus Web and Custom Rules** always record their findings on the [Vulnerabilities](https://scansuite.eu/documentation/usage/vulnerability-management) page.
- **The classic scanners** (Quick, Balanced, Deep Scan, API Scan, Nuclei, Acunetix) record their findings there too, at **Medium** severity and above, unless the team changes it: Teams, Scanning tab, **Scanner findings in Vulnerabilities** card, **Store scanner findings** (On by default) and **Lowest severity to store** (Medium by default). **Close findings a rescan no longer reports** in the same card decides whether a rescan closes them; see [Vulnerability Management](https://scansuite.eu/documentation/usage/vulnerability-management).
- **Everything** is in the scan's **Report** in Scan History and, when the team has DefectDojo connected, in DefectDojo (see [Set up DefectDojo](https://scansuite.eu/documentation/installation/set-up-defectdojo)). **Hidden Paths**, **Secrets** and **Tech Discovery** are never exported to DefectDojo; download the **Report** to review them.