Step 1: Create a Scan Project
- Navigate to Vulnerability Scanning > Projects & Scan Targets.
- Click Create Project.
- Name your project (e.g.,
Staging E-Commerce API). - Select your target type: Domain / FQDN, IP / CIDR Range, or OpenAPI / Swagger Definition.
Step 2: Select Scan Profile & Authentication
- Choose a Scan Profile:
- Quick Surface Scan: Fast port and banner discovery.
- Standard Web App Scan: OWASP Top 10, injection, and misconfiguration checks.
- Deep API Audit: Authenticated endpoint fuzzing and stateful testing.
- (Optional) Provide authentication credentials (OAuth2 token, API key, or custom HTTP headers).
Step 3: Run and Monitor the Scan
- Click Start Scan Now.
- View real-time progress, crawled endpoints, and active testing phases in the Scan Results view.
- Review detected vulnerabilities in the Finding Management catalog as soon as they are identified.