Scan Targets
The Scan Targets screen is where you register assets and run scans. The top of the screen summarizes your assets; below it is the list of registered targets.
Registering targets
Click Add URLs and enter one target per line.
- A given scheme (
http://,https://) is used as is - Without a scheme, the root page is fetched and whichever scheme responds is kept. Ports 80 and 8080 try http first; any other port tries https first
- A given path is the path that gets scanned; without one, the root (
/) is scanned - A target with the same host, port and path as an existing one is skipped as a duplicate
Malformed lines are listed in the dialog with their line number and reason. Fix them and add again.
Probing
Each added target is probed right away by fetching its root page. Progress is shown in a dialog.
| Status | Meaning |
|---|---|
| Checking | The root page is being fetched |
| Responding | A web server answered. The scheme and HTTP status code are recorded |
| Unreachable | No connection on the given scheme, or on neither http nor https when no scheme was given |
The response status code does not matter: a 404 or 500 still means a web server is there, so the target is recorded as Responding. For an Unreachable target, fix the firewall and then select it and Re-probe.
Statistics at the top
| Item | Shows |
|---|---|
| Total assets | Number of responding targets |
| Vulnerable | Targets whose latest scan found them vulnerable |
| Patched | Targets whose latest scan confirmed a patched version |
| Unscanned | Responding targets not scanned yet |
| Verdicts | Latest verdict distribution of responding targets, with the count of each verdict in the legend |
| PHP versions | Scanned targets per PHP version. Each cell shows the version, the asset count and the vulnerable count |
A red cell in the PHP version chart means that version has vulnerable assets. Use it to plan patching all assets on the same version together. Servers that do not expose their version are grouped as Not exposed.
Scanning
| Button | Scans |
|---|---|
| Scan all | Responding targets that are unscanned or whose latest verdict is vulnerable |
| Rescan | The targets selected in the list (responding ones only) |
While a scan runs, a dialog shows the number done, the vulnerable, patched and error counts, and the URL being checked. Stop scan cuts the requests in flight and stops at once; results of targets finished before that are kept.
Only one scan runs at a time per company. Each request times out after 60 seconds.
skips such targets.
List and filters
Filter the list by Status and Verdict, or type part of a host, path or PHP version into the search box. Selecting one or more rows turns the bar above the list into the selection actions (Rescan, Re-probe, Delete).
CSV downloads every target matching the current filters, not just the visible page.
Deleting
Select targets and click Delete; a confirmation dialog lists the URLs to be deleted. Deleting a target also deletes its scan result history, and cannot be undone.