Web application scan

The default and most comprehensive scan type. Covers the OWASP Top 10 plus 30+ adjacent classes. Runs against any URL reachable over HTTP/HTTPS.

What it checks

All of these fire in parallel (bounded concurrency) against endpoints the crawler discovered.

How the crawl works

1. Normalise the target — if you pasted example.com without a scheme, Pentestas auto-prepends https:// (and falls back to http:// only if HTTPS doesn't respond). The error you used to see — "Scheme '(empty)' is not allowed" — is gone.
2. Auto-login (if configured) — credentials supplied via the Authentication panel are exercised before the crawl, not after. The crawler then walks the app with a logged-in session from the start, so admin/user-only pages are part of the initial attack surface, not a second-pass discovery.
3. Fetch the root — follow redirects, harvest cookies.
4. Fingerprint — detect CMS / framework (WordPress, Drupal, Joomla, Symfony, Laravel, Django, Rails, Next.js, …) and load CMS-specific attack-surface modules (admin paths, plugin enumeration, framework debug endpoints).
5. Parse + extract — links, forms, fetch()/axios/XHR calls in JS bundles, <script src>, <img src>, iframes, WebSocket endpoints, JSON-RPC endpoints.
6. Render — headless Chromium (via Playwright) for SPA routes and anything hidden behind client-side routing. Fires hover/click heuristics on discovered interactive elements.
7. Parameter discovery — the fuzzer tries common parameter names against each endpoint (id, user, token, search, callback, and a few hundred more). Reflected-parameter endpoints make it into the attack-surface list even if the original page didn't reveal them.
8. Recurse — every new URL feeds back into the queue, up to the configured depth (default 3).

Framework-specific support

Beyond generic OWASP coverage, Pentestas runs framework-aware attack chains when it fingerprints:

• WordPress — plugin / theme enumeration, REST API user disclosure, xmlrpc abuse.
• Drupal / Joomla — version-pinned CVE checks, admin-path probing.
• Symfony — _profiler/, _wdt/, app_dev.php debug surfaces; CVE-2019-18889 fragment RCE; secret leakage from exposed dev configs; user enumeration via timing on the login endpoint.
• Laravel — .env exposure, debug-mode RCE.
• Rails / Django / Next.js — framework-specific admin paths, SSTI variants, deserialisation chains.

If your framework is detected, you'll see a [FINGERPRINT] line in the live feed naming it.

Authentication

If you supply credentials (see Authenticated scans), Pentestas logs in first, preserves the session, and crawls authenticated from the start — usually doubling the attack surface since admin/user-only pages become visible immediately rather than only after an unauthenticated pass.

Payload selection

Payloads are picked from a curated list of ~5,000 across the tool modules. The payload encoder tries common transformations (URL encode, double URL encode, Unicode, HTML entity, base64, case-flip) so a WAF that blocks ' alone doesn't block %27 or %EF%BC%87.

Rate limits and speed presets

The scan dialog's Advanced Options panel exposes three speed presets:

• Gentle (prod-safe) — low concurrency, longer delays, conservative payload selection. Use against production targets.
• Normal — the default. Balanced for staging environments and modern web apps.
• Aggressive (dev) — high concurrency, no delays. Use only on dev/staging targets you own.

Each preset sets concurrent connections per host, request spacing, and the size of the payload set tried per parameter. Switching presets after a scan starts has no effect — the values are read at scan-start.

Output

Findings flow into the standard list + exported to reports. Each finding carries:

• Endpoint, method, parameter
• Exact payload used
• Request + response evidence
• CVSS score + vector
• CWE + OWASP category
• Validation steps
• Exploit-DB matches (if applicable)
• AI-generated impact narrative + remediation (Pro+)

Common questions

Does it find 0-days? Sometimes. Pentestas doesn't ship with CVE-specific signatures — it runs behaviour-based tests. If your app has a novel auth bypass that matches the BFLA model, it gets caught.

Will it break production? By default, destructive verbs (DELETE requests, state-changing mutations) are annotated-but-not-executed — the tool reports "this endpoint looks like it accepts arbitrary user IDs but we didn't delete anything to confirm". Stick to the Gentle preset for production targets to keep request volume low.

Does it support WAFs? Yes. The scanner adapts: detects WAF fingerprints (Cloudflare, Akamai, AWS WAF, Imperva, F5, Sucuri) and switches to a low-noise payload distribution tuned to slip past generic rules.

See also

• API scan — when the target is primarily an API.
• Authenticated scans — hand over credentials so Pentestas scans logged-in UX.
• Manual testing tools — Forge / Volley / OAST / HTTP history etc., for hands-on probing of any scan.
• Browser capture — scan-as-you-browse from inside your corp network.