Our [authenticated] web-app scanner is built exclusively for web-apps and the servers that host them, focusing primarily on the web-apps' functionality and the configuration of services running on it.
What if my app doesn't require authentication?
Not to worry – you can still use the web-app scanner, when adding a new target as an external web app and we'll automatically add some dummy credentials to allow our scanner to kick of an unauthenticated scan!
For newly added web application targets
To do so head to the Targets page and click the yellow Add target button where you can then click add External web application:
Next, fill add the details of the web app you'd like to scan:
After clicking Add target, click Skip for now to scan your unauthenticated target:
And that's you all set! You'll then be taken to the scan detail page where you can kick off a scan of your new target if needed by hitting Scan now in the top right corner.
For existing infrastructure targets
Alternatively, if the target was previously added as an infrastructure target, the steps to add dummy credentials can be seen below:
1. Find the target in the Targets page and click into its Target Detail Page:
2. Click the Authentications tab and click Add Authentication
3. Select Header Authentication and enter the following credentials:
Name: Unauthenticated
Entrypoint URL: The URL of the target e.g.
http://testphp.vulnweb.comHeader Name:
X-Auth-TokenHeader Value:
Bearer Tm90IGEgdmFsaWQgYXV0aCB0b2tlbg==
4. Hit 'Save and verify authentication'.
Now, whenever you kick-off a scan on this target, it will be checked for all the usual infrastructure checks conducted by the underlying scanning engine (OpenVAS for Essential users, OpenVAS and Nuclei for Cloud, Tenable for Pro, and Tenable and Nuclei for Enterprise and Vanguard), plus checks from our web-app scanner.