Running a Scan
Path: /scans/new · Sidebar: Testing → DAST Scans → New Scan
This page walks through the new-scan wizard field by field.
Step 1 - Choose a target
Select an existing target. If you don't have one yet, create it first (Assets → Targets) or promote one from Discovery.
Step 2 - Pick a profile
| Profile | Time | What it does | Use when |
|---|---|---|---|
| Quick | ~5 min | Light crawl + key active checks | Smoke test, quick re-check |
| Standard | ~30 min | Full crawl + active scan + AI exploitation | Recommended default |
| Deep | 1-2 h | Full crawl + all engines (signature templates, schema fuzzing) | Pre-release, periodic deep audit |
| Savage | 2-4 h | Everything in Deep plus offensive recon, WAF-bypass mutation, deep content discovery (recursion + backup/leak sweep), forced OAST and LLM app-security | Authorized red-team-style assessment |
Deep enables every standard scanner; Savage goes further with offensive-recon and mutation techniques and is authorization-gated - only run it against systems you are explicitly authorized to test.
Step 3 - Scope & exclusions
- Include / exclude paths - keep the scan inside the intended scope (e.g.
exclude
/logout,/admin/delete). - Excluded parameters - skip fields you don't want fuzzed.
- This protects destructive endpoints and keeps noise down.
Step 4 - Advanced options
- Authentication - pick the configured auth so the scan runs logged-in (Authenticated scanning).
- Pentest instructions - optional plain-English hints (e.g. "focus on the coupon redemption flow") that steer targeted testing.
- SPA / AJAX crawling - enable for single-page apps so client-rendered routes are discovered.
Step 5 - Start
Click Start Scan. You're taken to the scan detail page with a live progress bar and activity log. The scan continues even if you navigate away.
The scans list
Path: /scans
The list shows every scan with its status - pending, queued, running,
completed, failed - and lets you group by target, status or profile. From a
completed scan you can rescan with the same settings in one click.
After remediation, re-run the same profile against the same target to confirm fixes. The Assessments history lets you compare runs over time.