Scanner Identification

These settings are under Scan preferences > How should the scanners be recognizable? in the scan profile settings.

User Agent

The scan’s device sets the user agent sent in HTTP requests and the screen size used when crawling. By default, Application Scanning uses this user agent:

Mozilla/5.0 (compatible; Detectify) +https://detectify.com/bot/{token}

Visiting the link shows who started the scan and when. The link is added to every user agent, so the source of the traffic can always be identified.

Instead of the default, you can:

• Select a predefined device, which changes both the user agent and the screen size.
• Add a custom user agent, which keeps the default screen size. A custom user agent can include these variables: %scan-profile-name%, %scan-profile-token% and %scan-profile-endpoint%.

Changing the device changes only the user agent and the screen size. It doesn’t emulate the device’s browser engine.

A scan uses the same device from start to finish. Your application may behave differently for different devices, such as mobile and desktop, and each behavior can hold different vulnerabilities. To cover them, change the device between scans, or create one scan profile per device.

Some sites block unknown bots, or user agents that contain “Detectify”, so pages render blank or the scan is refused. Changing the user agent can fix this. To let the scanner through your firewall, allowlist the scanner IP addresses rather than the user agent: a user agent is easy to spoof, and the IP addresses aren’t.

Custom Headers

Add headers, each with a name and a value, that the scanner sends with its requests. Use them to identify the scanner’s traffic in your logs, or to let it through your own access controls.

To avoid conflicts with the headers the scanner uses for testing, such as Host, use the Authorization header or the prefix shown in the custom headers dialog.

Custom Cookies

Add cookies that the scanner sends with its requests. A cookie needs a name, a value and the domain it applies to, and can be marked as Secure or HTTP-only. Use them to identify the scanner’s traffic or to set site behavior, such as a locale.

Don’t use custom cookies to carry a login session. Session cookies expire, so the session breaks during or between scans. To scan behind login, see Authentication.

Next Steps

• Scanner IP Addresses — Allowlist Application Scanning traffic
• Settings — All scan profile settings