Web Application Vulnerability Scan

What this check runs

This check runs a Wapiti style web application vulnerability scan. It crawls your application to map its inputs, then injects test payloads into each to probe for a broad set of vulnerability classes: injection, cross-site scripting, file inclusion, command execution, insecure redirects and more.

Like the ZAP check it is breadth-first and dynamic, testing the running application rather than the source, but it approaches the site through its own crawl-and-inject methodology.

Why it matters

Application vulnerabilities live in the seams between your code and its inputs, and those seams are only fully visible at runtime. A dynamic scan follows your actual forms, query parameters and endpoints and tests what each does with hostile input, catching the reflected XSS, the injectable parameter or the unvalidated redirect that a reading of the code might miss.

Running more than one scanner methodology is deliberate. Different scanners crawl differently and carry different payload sets, so one surfaces what another misses. Treat this and the ZAP check as complementary breadth rather than duplication.

What the findings mean

Findings are grouped by vulnerability class with severities. A high-severity finding such as an injection or command-execution point is urgent; lower-severity findings are worth clearing in order. Because this is a breadth scan, use it to know which categories of problem exist, then the specific fix guides to close each.

Run a scan to see the current findings for your application, and pair anything serious with the matching fix page.