Web application scan

The default and most comprehensive scan type. Covers the OWASP Top 10 plus 30+ adjacent classes. Runs against any URL reachable over HTTP/HTTPS.

What it checks

All of these fire in parallel (bounded concurrency) against endpoints the crawler discovered.

Coverage-expansion detectors (May 2026)

Pentestas continuously expands the detector mix. Recent additions you'll see firing on every web scan:

Cross-references: Exploitation chains consume the outputs of these detectors and walk them into demonstrated impact (admin login, AWS-credential extraction, money movement, RCE).

Live Ops attack visualization

While a scan is running, the scan-detail page renders a real-time canvas showing the engine's activity — hex nodes for the WEB / API / AUTH / DB / ADMIN / CLOUD services, animated packets representing in-flight probes, finding pings as they emit, and a phase badge that flips between RECON / VULN-DISC / EXPLOITATION / DEFERRED / INFRASTRUCTURE. It's the cyberpunk ops-HUD you'd expect from a real pentest engagement, not the "Scanning… 47% complete" bar of a typical scanner. The viz auto-tears-down once the scan transitions to complete so the canvas + RAF loop don't leak on navigation.

How the crawl works

1. Normalise the target — if you pasted example.com without a scheme, Pentestas auto-prepends https:// (and falls back to http:// only if HTTPS doesn't respond). The error you used to see — "Scheme '(empty)' is not allowed" — is gone.
2. Auto-login (if configured) — credentials supplied via the Authentication panel are exercised before the crawl, not after. The crawler then walks the app with a logged-in session from the start, so admin/user-only pages are part of the initial attack surface, not a second-pass discovery.
3. Fetch the root — follow redirects, harvest cookies.
4. Fingerprint — detect CMS / framework (WordPress, Drupal, Joomla, Symfony, Laravel, Django, Rails, Next.js, …) and load CMS-specific attack-surface modules (admin paths, plugin enumeration, framework debug endpoints).
5. Parse + extract — links, forms, fetch()/axios/XHR calls in JS bundles, <script src>, <img src>, iframes, WebSocket endpoints, JSON-RPC endpoints.
6. Render — headless Chromium (via Playwright) for SPA routes and anything hidden behind client-side routing. Fires hover/click heuristics on discovered interactive elements.
7. Parameter discovery — the fuzzer tries common parameter names against each endpoint (id, user, token, search, callback, and a few hundred more). Reflected-parameter endpoints make it into the attack-surface list even if the original page didn't reveal them.
8. Recurse — every new URL feeds back into the queue, up to the configured depth (default 3).

Framework-specific support

Beyond generic OWASP coverage, Pentestas runs framework-aware attack chains when it fingerprints:

• WordPress — plugin / theme enumeration, REST API user disclosure, xmlrpc abuse.
• Drupal / Joomla — version-pinned CVE checks, admin-path probing.
• Symfony — _profiler/, _wdt/, app_dev.php debug surfaces; CVE-2019-18889 fragment RCE; secret leakage from exposed dev configs; user enumeration via timing on the login endpoint.
• Laravel — .env exposure, debug-mode RCE.
• Rails / Django / Next.js — framework-specific admin paths, SSTI variants, deserialisation chains.

If your framework is detected, you'll see a [FINGERPRINT] line in the live feed naming it.

Authentication

If you supply credentials (see Authenticated scans), Pentestas logs in first, preserves the session, and crawls authenticated from the start — usually doubling the attack surface since admin/user-only pages become visible immediately rather than only after an unauthenticated pass.

Payload selection

Payloads are picked from a curated list of ~5,000 across the tool modules. The payload encoder tries common transformations (URL encode, double URL encode, Unicode, HTML entity, base64, case-flip) so a WAF that blocks ' alone doesn't block %27 or %EF%BC%87.

Rate limits and speed presets

The scan dialog's Advanced Options panel exposes three speed presets:

• Gentle (prod-safe) — low concurrency, longer delays, conservative payload selection. Use against production targets.
• Normal — the default. Balanced for staging environments and modern web apps.
• Aggressive (dev) — high concurrency, no delays. Use only on dev/staging targets you own.

Each preset sets concurrent connections per host, request spacing, and the size of the payload set tried per parameter. Switching presets after a scan starts has no effect — the values are read at scan-start.

New-scan form — every option

The full reference for every field on the New scan → Web tab. Hidden fields under collapsed sections are documented in the same order they appear in the dialog.

Basics

Attack Strength

Target Authentication (7 methods)

Pick whichever shape matches the target. Each method's secret is encrypted per-tenant and never written to a scan row in plaintext; a has_credentials: true breadcrumb is the only persisted fact. See Authenticated scans for the full flow.

Advanced Options

Active Exploitation

The "Active Exploitation" panel is what turns Pentestas from "vulnerability scanner" into "demonstrated impact." Every checkbox here gates a layer of follow-up automation.

When any of these run successfully, the chain emits a single CRITICAL EXPLOIT_CHAIN finding with a numbered playbook. See Exploitation chains.

Bulk Domain Scan

One target per line; all must be verified. Same scan-types are applied to every target. Useful for verified-tenant fleets where every subdomain should be tested on the same cadence. The bulk panel exposes its own AI provider/model override that applies to every scan in the batch.

Output

Findings flow into the standard list + exported to reports. Each finding carries:

• Endpoint, method, parameter
• Exact payload used
• Request + response evidence
• CVSS score + vector
• CWE + OWASP category
• Validation steps
• Exploit-DB matches (if applicable)
• AI-generated impact narrative + remediation (Pro+)

Common questions

Does it find 0-days? Sometimes. Pentestas doesn't ship with CVE-specific signatures — it runs behaviour-based tests. If your app has a novel auth bypass that matches the BFLA model, it gets caught.

Will it break production? By default, destructive verbs (DELETE requests, state-changing mutations) are annotated-but-not-executed — the tool reports "this endpoint looks like it accepts arbitrary user IDs but we didn't delete anything to confirm". Stick to the Gentle preset for production targets to keep request volume low.

Does it support WAFs? Yes. The scanner adapts: detects WAF fingerprints (Cloudflare, Akamai, AWS WAF, Imperva, F5, Sucuri) and switches to a low-noise payload distribution tuned to slip past generic rules.

See also

• API scan — when the target is primarily an API.
• Authenticated scans — hand over credentials so Pentestas scans logged-in UX.
• Manual testing tools — Forge / Volley / OAST / HTTP history etc., for hands-on probing of any scan.
• Browser capture — scan-as-you-browse from inside your corp network.