Optional Features
The optional features are under Scan profile settings > Toggle the following features. All seven are off by default.
Three of the toggles are named Disable: turning one on stops something that otherwise happens. The other four add something that otherwise doesn’t run.
| Toggle | When it’s on |
|---|---|
| Disable connection reuse | The scanner closes connections between requests instead of reusing them |
| Disable denial-of-service (DoS) tests | The scan leaves out the tests most likely to disrupt your application through load or resource exhaustion |
| Disable DOM XSS | The scan leaves out DOM cross-site scripting tests |
| Missing security headers | The scan checks endpoints for recommended security headers |
| Run missing security header tests against all paths | The header check runs on every path saved during the crawl, not only the origin. Needs Missing security headers on |
| Allow filling forms | The crawler fills in and submits forms it finds, and the submissions are tested further |
| Enable JWT Assessments | The scan runs passive and active assessments of how your application handles JSON Web Tokens |
Form Filling
With Allow filling forms on, the crawler guesses what kind of value each field needs from its autocomplete value and input type, and fills in one of these values:
| Field type | Value |
|---|---|
| Given name | Detectify |
| Additional name / middle name | Breathtaking |
| Family name / last name | Detectifysson |
| Honorific prefix | Dr. |
| Honorific suffix | PhD. |
| Nickname | Deckan |
| bot@detectify.com | |
| Password | A random, unique string |
| Organization | detectify |
| Street address | Detectifyway 1 |
| Country | Sweden |
| Zip code | 12345 |
| Gender | Robot |
| Telephone | 12345678 |
| URL | https://detectify.com |
| Uncategorized | Detectify |
The password is random the first time a scan profile runs with form filling on. Later scans on the same profile use the same password. If the crawler can’t tell what a field needs, it uses the uncategorized value.
The crawler fills in text areas, radio buttons, checkboxes and drop-down menus. In a drop-down, it looks for the default value for that field type, such as Sweden for a country, and picks the first option if it doesn’t find it.
To use different values, contact support with the name of your scan profile, the URL the form is on, the type of value, and the value you want submitted.
Form filling submits forms, including contact forms. See Scan Impact for how to keep scans away from forms that send emails or create tickets.
Next Steps
- Scan Impact — Limit side effects of scans
- Coverage — What Application Scanning tests for
- Settings — All scan profile settings