Vulnerability Scanning
Run web and infrastructure scans and understand the profiles.
Video walkthrough coming soon
The written steps below cover everything in the meantime.
What you'll learn
- The difference between the scan profiles
- Which profile to use for a URL vs an IP vs a repo
- How results are deduplicated across scans
Step-by-step
- 1
Pick a profile
Full Security Audit (nmap, nuclei, testssl, zap) is the general-purpose choice. Deep Infrastructure Scan focuses on network/host checks. Nikto Web Scan and Web Application Audit are web-focused.
- 2
Match input to profile
Web/infra profiles need a target (URL/IP/domain). Code profiles (semgrep, gitleaks) need a git repository instead — see Code Intelligence.
- 3
Launch and wait
Start the scan and let it complete in the background. You can queue several scans across different targets.
- 4
Deduplication
The same issue found across multiple scans is collapsed into one finding with first-seen, last-seen, and a scan count. Issues that stop appearing are auto-resolved.