Defense.com's App Scanner allows you to regularly assess your web applications for vulnerabilities and is the perfect supplement to regular human-led penetration tests, without the expensive day rates.
Setting up a scan
From the my.defense.com dashboard, select Protection
Next, select App Scanning
From the App Scanning show page, click + Add Scan in the top right-hand corner
Configure the scan by completing all the required fields, including the URL of the application you'd like to scan, selecting a Minimum confidence level and a Scan template
When you're happy with your selections, hit the Add Site button at the bottom of the page
Allowing app.scanner.defense.com or 74.220.22.174 through your firewall may be required to ensure the scanner returns the best possible results.
Selecting a scan template
Our App Scanner currently offers two different scan templates (Base and Full), which perform different checks to varying degrees of depth.
Base
Is a low-risk option, designed for scanning live production applications. It analyses traffic and performs passing checks only, looking for issues such as missing security headers, outdated libraries, or exposed information.
Full
Is a more aggressive scan which will look to replicate common attack techniques and expose issues such as XSS and SQL injection. As a result, it can trigger security systems or generate log data, which means it should be used with caution on production systems.
Selecting a minimum confidence level
The minimum confidence level allows you to control the issues reported during a scan. This is based on how certain the scanner is that the issue exists, given the results of the checks performed. The options available are:
False positive
Low
Medium
High
Confirmed
Selecting False Positive would result in the scanner reporting all issues, including those checked and found not to exist within the application being scanned. Whereas selecting Confirmed would only return issues validated by the scanner and confirmed as present within the application.
Performing a scan
Once a scan has been set up, you'll be automatically redirected to the scan show page, where you can click Start Scan
Alternatively, from the my.defense.com dashboard, select Protection
Next, select App Scanning
Finally, click the Run app scan now button in the Actions column
Viewing the scan results
Once a scan is complete (how long this will take depends on the size and complexity of the application, the scan template selected, and the minimum confidence level), threats will be created in your threat management interface. To access these:
From the my.defense.com dashboard, select Threats from the left-hand navigation
Next click Threat List
Finally, on the threat index page, use the filters to filter by the Type: App Scan
From here you'll be able to view a description of the issue found and step-by-step remediation advice. For further information on how to manage your threats, please see this guide.
And that's it! 🎉 You've successfully performed an app vulnerability scan.