01
Web application scanning
Testing across a web application's authentication, access control, injection points, configuration and business logic. Only confirmed findings go in the report.
Scope and depth agreed before testing starts.
Scan types
Web application and API security scanning
Scans are black-box: SkilledScan tests the running application or API from the outside, the way an attacker would, without needing your source code. Every scan type ends in the same kind of report: evidence and a fix for each finding, plus a record of what was covered.
02
API scanning
Testing of REST and GraphQL APIs for broken authorization, injection, and data exposure, driven from your routes or specification.
Bring an OpenAPI or Postman collection, or we map the routes first.
03
Rescan and sign-off
After you fix, the reported findings are scanned again and a closeout states what was resolved.
Covers the findings from a prior scan.
Coverage
What every scan covers
Coverage includes common OWASP Top 10 risk areas such as broken access control, injection and security misconfiguration; formal OWASP Top 10 mapping in the report is on the roadmap. Depth depends on the scan type and on what the target runs, and each report's coverage section states what was scanned and what was not.
01Attack surface
- Subdomains and exposed services
- Technology and version fingerprinting
- API routes and hidden parameters
02Injection
- SQL injection
- Cross-site scripting
- CRLF injection
03Access and session
- Broken access control
- Authentication and session weaknesses
- JWT weaknesses
- CORS misconfiguration
04Configuration
- TLS configuration
- Security headers
- Platform-specific checks for common CMS stacks
05Known vulnerabilities
- Version-matched known vulnerabilities
- Cross-reference with public advisories
- 01Executive summary
- 02Risk breakdown
- 03Scope and rules of engagement
- 04Methodology
- 05Findings, each with evidence and a fix
- 06Remediation summary
- 07Coverage: what was tested and what was not
- 08Tools and references appendix
Next step
Send one URL to get started.
Email contact@skilledscan.com with the application or API you want scanned. Written authorization is confirmed before any scan runs.