सार्वजनिक गाइड

Verify Assets and Run DAST Deep Scans

Verify control of an internet-facing asset, launch a bounded application scan, follow durable progress, and interpret findings or partial-result warnings safely. लक्षित पाठक: Application security teams, workspace admins, and service owners. सामान्य सेटअप समय: 10-20 minutes.

reference

इसका उपयोग करें यदि

Verify control of an internet-facing asset, launch a bounded application scan, follow durable progress, and interpret findings or partial-result warnings safely.

लक्षित दर्शक: Application security teams, workspace admins, and service ownersविशिष्ट समय: 10-20 minutes

शुरू करने से पहले

  • You need dashboard write permission and a plan that includes EASM and DAST.
  • Only scan systems your organization owns or is explicitly authorized to test.

मार्गदर्शिका वॉकथ्रू

1

चरण 1

Verify the exact EASM asset

BlackShield disables active scanning until the workspace proves control of the exact DNS name or public IP.

  • Open `/easm`, locate the asset, and choose Verify to scan.
  • For DNS assets, publish the displayed TXT name and exact challenge value.
  • For public IP assets, publish the exact value at the displayed `/.well-known/blackshield-verification.txt` path.
  • Choose Check verification. Verification lasts 30 days and does not automatically cover subdomains.
  • Copy the verified asset UUID from the success dialog or asset card. Jenkins uses the same value in the `dast-test-asset-id` Secret Text credential.
  • Reopening verification loads the current challenge. Create is idempotent; rotate only when you intend to replace the published proof.

सफलता कैसी दिखती है

Reopening verification loads the current challenge. Create is idempotent; rotate only when you intend to replace the published proof.

2

चरण 2

Choose a bounded scan profile

Launch Deep Scan from EASM or open the DAST Scanner and select one or more verified assets.

  • Use Quick for a 25-page baseline, Standard for routine 100-page coverage, or Deep for up to 250 pages and depth 3.
  • Add authentication headers or cookies only when the scan needs an authenticated session; values are encrypted and never returned in job responses.
  • Review the selected assets and confirm your authorization before launching.
  • Launch rechecks ownership. A missing proof is rejected, while a temporary DNS, TLS, network, or upstream outage remains retryable and does not erase a valid proof.
  • Each target has a 12-minute execution budget and a maximum of two scans may be active per workspace.

सफलता कैसी दिखती है

Each target has a 12-minute execution budget and a maximum of two scans may be active per workspace.

3

चरण 3

Follow progress and interpret results

Scan History reports queued, crawling, testing, finalizing, completed, warning, failed, and cancelled states.

  • Open a job to review per-target progress, the redacted discovered-URL inventory, successful probes, per-template check coverage, findings, evidence, and remediation.
  • Zero findings are meaningful only when Check coverage shows successful probes. A zero-check scan is marked Completed with warnings and must not be treated as a clean result.
  • Completed with warnings means usable partial findings were retained because one or more targets timed out or failed; review each target warning before treating coverage as complete.
  • Failed jobs show an actionable orchestration or validation error. A job must never remain queued indefinitely; contact support with the job ID if reconciliation marks it failed.
  • Cancel active jobs from Scan History. Late worker results are ignored after cancellation.

सफलता कैसी दिखती है

Cancel active jobs from Scan History. Late worker results are ignored after cancellation.

Demonstration only

This configuration is designed for ease of use. To deploy scanner clients at scale, please plan your deployment architecture accordingly or contact us for enterprise best practices.

यह चलाएँ

Create a verified-asset scan
curl -X POST "$BLACKSHIELD_URL/api/v1/dast/scans" \
  -H "Authorization: Bearer $BLACKSHIELD_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"config":{"targets":[{"asset_id":"<asset-id>","scheme":"https","base_path":"/"}],"profile":"standard"}}'

सफलता कैसी दिखती है

  • The EASM asset status changes to Verified on the dashboard, making Deep Scan options available.
  • The job advances beyond queued and reaches a terminal state with per-target outcomes.
  • Authentication values do not appear in job details, findings evidence, or request headers.
Verify Assets and Run DAST Deep Scans | BlackShield Docs