Scan a web application

Vulnara can test a running web application from the outside, the way a visitor on the internet sees it. You add the application under Web applications, start a scan, and Vulnara lists what it found, with a severity and the URL where it found it. In the app this is the Web application category, also known as DAST.

What it is for

• Finding problems in a running application, such as an exposed admin page or file, a product version with a known vulnerability, a TLS problem or a misconfiguration.
• Checking the applications you publish on the internet regularly, alongside the code scans of the repositories behind them.

What it checks

Web application scans run safe, non-intrusive checks only. It does not do intrusive testing such as fuzzing or password guessing. Pages behind a login are tested when you give the target a sign-in, see Scan pages behind a login. A clean result means these checks found nothing; it is not a penetration test.

What you can set

• Name: a label for the application, such as Customer portal.
• Base URL: the address of the application, such as https://app.example.com. It must be publicly reachable over http or https. Private or internal addresses, such as 10.0.0.5 or app.internal, are refused.
• In-scope paths: only report findings under these paths, such as /app. Leave empty for the whole site.
• Excluded paths: leave out findings under these paths.
• Ownership confirmation: you confirm that you own the application or have permission from its owner to scan it.

Do it

1. Add the web application

   Open Web applications under Assets in the sidebar and choose Add web application. Enter a name and the base URL, add paths if you need them, tick the ownership confirmation and choose Add web application.

2. Start the scan

   Select the target, choose Start a scan and confirm with Start scan. If the scan cannot start, the dialog says why, for example that the address is not publicly reachable or that your plan's web scan minutes are used up.

3. Follow or cancel it

   The scan shows in the tasks bar under the target's name, and on the target's screen. You can cancel it from either place. A scan usually takes several minutes.

4. Read and triage the findings

   Open the target and its Scans tab, then choose View findings. They open in Vulnerabilities under the Web application type, where you can filter them and record decisions as on any other finding. See Triage findings.

Scan pages behind a login

Without a sign-in, a scan sees only what an anonymous visitor sees. Give the target the sign-in of a test account and the scan also covers the pages that account can reach.

1. Open the sign-in settings

   Open the web application. On its Overview tab, the Sign-in card lists the sign-in methods the target has. Choose Add sign-in method.

2. Choose how the application signs you in

   Pick the method and fill in its fields:

   • Header: a header name, such as X-API-Key, and its value.
   • Bearer token (JWT): a token sent as Authorization: Bearer <token>. Enter the token without the word Bearer.
   • Cookie: a cookie name and its value, such as a session cookie.
   • Basic auth: a username and password.

3. Save it

   Choose Save sign-in method. From then on, every scan of the target, including scheduled ones, signs in. A scan already running keeps the sign-in it started with.

Combine several methods

A web application can have up to 10 sign-in methods, and every scan sends all of them. Use this when one is not enough, for example when the whole site sits behind Basic auth and the application itself expects a token, or when it needs a session cookie and an API key header together. Add each one with Add sign-in method.

A target can have:

• one Basic auth,
• one Bearer token,
• one Header per header name,
• one Cookie per cookie name.

Basic auth, a Bearer token and a header named Authorization all set the same Authorization header, so a target can have only one of them. If the site uses Basic auth and the application also needs a JWT, send the token in a custom header your application reads, such as X-Access-Token. The form explains a combination it cannot accept before you save.

Change or remove a method

The secret is write-only. After you save it, Vulnara shows only the method, the header name, cookie name or username, and when it was last changed, never the value itself. To change a value, add the method again with the same name: it replaces the current one, and the form says so before you save. To stop sending a method, choose Remove next to it. With no method left, scans only reach public pages. Adding and removing sign-in methods need the editor role.

A session cookie or token that expires stops working for later scans. Add it again with a fresh value, or use a long-lived token for the test account.

Scan on a schedule

Open the web application, go to its Schedules tab and choose Add schedule. Pick daily or weekly and a time, and the target is scanned on that cadence. If a scheduled run cannot start, for example because the address no longer points to a public site or your plan's limit was reached, the schedule shows why under its row. See Schedule recurring scans.

Reports

Choose Download report on a web application for a PDF of that application: its latest scan, every finding with its triage state, and its recent scans. The workspace security summary PDF also has a Web application section covering all your web applications. See PDF reports.

Use the API, the CLI or CI

• GraphQL: createWebTarget, startWebScan, webScanResults, dastFindings, and addWebTargetSignInMethod and removeWebTargetSignInMethod for the sign-in methods. setWebTargetCredentials replaces all of them with one, and clearWebTargetCredentials removes all of them. The target's signIn field lists the methods and never returns a secret.
• CLI: create_web_target, start_web_scan, web_scan_results, dast_findings and more. See Command-line interface.
• GitHub Action: scan a web application from a workflow, for example right after a preview deploy, and fail the job on what it finds. See GitHub Action.
• An AI client over MCP can read web applications, scans and findings, but cannot start a scan or change a sign-in.

Good to know

• Adding and deleting web applications and starting scans need the editor role. Viewers can see targets, scans and findings.
• Your plan limits web scan minutes and how many web applications you can hold, and web scans count towards the number of scans running at once. Your usage is under Settings, Billing, Usage this month. See Plans, usage and billing.
• The dashboard figures do not include web application findings yet. The workspace security summary PDF does.
• Deleting a web application also removes its scans and findings.
• Applications that are only reachable on a private network cannot be scanned yet.