Classification
Classification organizes your attack surface by the type of web asset, so you know which of your assets are important web apps that need deeper testing. Open it from Classification under Scan configuration in the main menu.
How It Works
Classification is built on top of Surface Monitoring and uses the data that Surface Monitoring has already collected. It uses the same IP addresses and user agents as Surface Monitoring. See Scanner IP Addresses.
HTTP assets are classified. Detectify mimics a browser and reports the same behavior a browser would, so the response over HTTPS takes priority over the response over HTTP.
Asset Classes
| Class | Description |
|---|---|
| 3xx external redirect | Redirects the client outside the domain it started on, for example example.com/ to blog.example.com |
| 3xx internal redirect | Redirects the client to a different path on the same domain, for example example.com/ to example.com/login |
| 4xx client error | The request failed because of an issue on the client’s side, for example 403 (Forbidden), which could mean missing authentication or a WAF blocking the client, or 404 (Not Found) |
| 5xx server error | The server hit an unexpected condition that prevented it from fulfilling a valid-looking request, for example 500 (Internal Server Error) or 503 (Service Unavailable) |
| Misc webapp | A small HTML application that responds with 200 and a body shorter than 100 characters, such as an unfinished “Hello World” site, a blocked-access message, or a default configuration page |
| API | A domain used for accessing an API, serving content such as JSON, XML, or plain text |
| Basic webapp | A web application that serves real content but has basic functionality, such as a site serving static HTML |
| Rich webapp | A web application with lots of JavaScript, software such as cookie consent, analytics, and marketing tools, security headers, and a lot of content |
What to Scan with Application Scanning
Application Scanning digs deep into complex web applications: it crawls to find every page, can test behind login with Recorded Login, and fuzzes with payloads for thousands of vulnerabilities. Use it for your rich webapps. See Application Scanning.