Black-box testing for web apps and APIs
Web and API security scanning that reports only what it can reproduce.
SkilledScan tests your web apps and APIs inside the scope you approve. Anything it can't reproduce stays out of the report, and every finding that makes it in comes with the evidence and a fix.
One scan: 201 raw observations, 7 confirmed findings reported. Duplicates, non-issues and noise stay in the raw log for audit.
Real result: one authorized client scan, client details withheld
2017
raw observationsconfirmed findings
Every candidate is reproduced before it reaches the report. On this scan that removed 194 duplicates, non-issues and noise. They stay in the raw log, so your auditor can still see them.
Why SkilledScan
Most scanners hand you a list. Someone still has to work out which items are real.
| Raw scanner output | A SkilledScan report | |
|---|---|---|
| Candidates | Hundreds of possibilities, none confirmed | Each one reproduced before it is reported |
| Duplicates and noise | Mixed in with real issues | Kept in the raw log, out of the report |
| What to do next | Your team triages the list | Prioritized findings with evidence and a fix |
| Audit trail | Rarely kept | Every proposed, allowed and blocked action logged |
Platform
What runs on every scan
- Attack surface discovery
- Maps subdomains, exposed services, technologies, routes and parameters before testing.
- Approved check registry
- Checks come from a fixed, approved registry and are picked to match the target.
- Sandboxed and rate-limited
- Checks run in isolated sandboxes, non-destructive, within the agreed scope.
- Confirmed findings
- Raw observations are kept apart from findings that were reproduced and confirmed.
- Audit log
- Every proposed, allowed and blocked action is recorded for your auditor.
- HTML and PDF reports
- Executive summary, risk breakdown, evidence, fixes and coverage in one report.
How it works
How a scan runs
- 1
Recon and OSINT
Map the target before touching it.
- 2
Enumeration
Find the endpoints, parameters, and surfaces worth testing.
- 3
Vulnerability analysis
Match the surface to likely weaknesses.
- 4
Active testing
Test the candidates under strict limits.
- 5
Verification
Every candidate finding is reproduced before it is reported.
- 6
Reporting
Write it up for the people who have to act on it.
The report
What the report looks like
At a glance
38 findings, by severity
- medium
- 4 medium
- low
- 11 low
- info
- 23 info
Severity mix from one delivered scan: 4 medium, 11 low, 23 info.
- 01Executive summary
- 02Risk breakdown
- 03Scope and rules of engagement
- 04Methodology
- 05Findings, each with evidence and a fix
- 06Remediation summary
Scan types
Three ways to scan
Web application scanning
Testing across a web application's authentication, access control, injection points, configuration and business logic. Only confirmed findings go in the report.
DetailsAPI scanning
Testing of REST and GraphQL APIs for broken authorization, injection, and data exposure, driven from your routes or specification.
DetailsRescan and sign-off
After you fix, the reported findings are scanned again and a closeout states what was resolved.
Details
Next step
Send one URL to get started.
Email contact@skilledscan.com with the application or API you want scanned. Written authorization is confirmed before any scan runs.