Recorded Crawling
Recorded Crawling replays user flows you record, so the scan covers steps the crawler can’t complete on its own. Examples are filling in and submitting a complex form, or adding items to a cart and filling in shipping details. Every unique HTTP request the recording triggers during the scan is saved for security testing.
Recorded Crawling doesn’t log in or keep the scanner logged in. To scan behind login, use Recorded Login.
Record and Upload a Flow
- Record the flow with the same Chrome extension you use for Recorded Login. See Recorded Login for how to install it and record.
- Download the recording from the extension.
- In the scan profile settings, go to Scan preferences > What should we scan? > Recorded Crawling and upload the file.
You can upload more than one recording. Keep each recording as short and simple as possible, so it keeps working as your application changes.
Flows Behind Login
If the scan profile uses Recorded Login, the scan replays the login first and then your Recorded Crawling files. Start each Recorded Crawling recording from the state your login ends in, which is usually the page you land on right after logging in.
The extension records in incognito mode, so you have to log in again while you record the flow. Before you upload the file, remove those login steps from it so the scan doesn’t log in twice. See Recorded Login File Format for how the file is structured.
Check the Result
Recorded Crawling files aren’t validated when you upload them. After a scan, look for the Recorded Crawling Succeeded or Recorded Crawling Failed finding in the scan results. If a recording couldn’t be used, the scan also shows a Recorded Crawling failed warning.
Next Steps
- Recorded Login — Scan behind login
- Paths and URLs — Add crawl starting points
- Settings — All scan profile settings