Running a Scan
Path: /scans/new · Sidebar: Testing → DAST Scans → New Scan
This page walks through the new-scan wizard field by field.
Step 1 - Choose a target
Select an existing target. If you don't have one yet, create it first (Assets → Targets) or promote one from Discovery.
Step 2 - Pick a profile
| Profile | Time | What it does | Use when |
|---|---|---|---|
| Quick | ~5 min | Light crawl + key active checks | Smoke test, quick re-check |
| Standard | ~30 min | Full crawl + active scan + AI exploitation | Recommended default |
| Deep | 1-2 h | Full crawl + all engines (signature templates, schema fuzzing) | Pre-release, periodic deep audit |
| Savage | 2-4 h | Everything in Deep plus offensive recon, WAF-bypass mutation, deep content discovery (recursion + backup/leak sweep), forced OAST and LLM app-security | Authorized red-team-style assessment |
Deep enables every standard scanner; Savage goes further with offensive-recon and mutation techniques and is authorization-gated - only run it against systems you are explicitly authorized to test.
Step 3 - Scope & exclusions
- Include / exclude paths - keep the scan inside the intended scope (e.g.
exclude
/logout,/admin/delete). - Excluded parameters - skip fields you don't want fuzzed.
- This protects destructive endpoints and keeps noise down.
Step 4 - Advanced options
- Authentication - pick the configured auth so the scan runs logged-in (Authenticated scanning).
- API spec (OpenAPI / Swagger) - point at a spec URL so declared endpoints are exercised directly, not just what the crawler finds. The URL is validated against SSRF (internal addresses are rejected).
- Pentest instructions - optional plain-English hints (e.g. "focus on the coupon redemption flow"). These do more than steer: the agent turns a multi-step hint into a workflow it executes and proves by reading state back.
- SPA / AJAX crawling - enable for single-page apps so client-rendered routes are discovered.
Step 5 - Start
Click Start Scan. You're taken to the scan detail page, where the live Agent Cockpit narrates the run phase by phase. The scan continues even if you navigate away.
The scans list
Path: /scans
The list shows every scan with its status - pending, queued, running,
completed, failed - and lets you group by target, status or profile. From a
completed scan you can rescan with the same settings in one click.
After remediation, re-run the same profile against the same target to confirm fixes. The Assessments history lets you compare runs over time.