Guia público

Verify Assets and Run DAST Deep Scans

Verify control of an internet-facing asset, launch a bounded application scan, follow durable progress, and interpret findings or partial-result warnings safely. Público: Application security teams, workspace admins, and service owners. Tempo típico de configuração: 10-20 minutes.

reference

Use isto se

Verify control of an internet-facing asset, launch a bounded application scan, follow durable progress, and interpret findings or partial-result warnings safely.

Audience: Application security teams, workspace admins, and service ownersTypical time: 10-20 minutes

Antes de começar

  • You need dashboard write permission and a plan that includes EASM and DAST.
  • Only scan systems your organization owns or is explicitly authorized to test.

Guide walkthrough

1

Passo 1

Verify the exact EASM asset

BlackShield disables active scanning until the workspace proves control of the exact DNS name or public IP.

  • Open `/easm`, locate the asset, and choose Verify to scan.
  • For DNS assets, publish the displayed TXT name and exact challenge value.
  • For public IP assets, publish the exact value at the displayed `/.well-known/blackshield-verification.txt` path.
  • Choose Check verification. Verification lasts 30 days and does not automatically cover subdomains.

Como é o sucesso

Choose Check verification. Verification lasts 30 days and does not automatically cover subdomains.

2

Passo 2

Choose a bounded scan profile

Launch Deep Scan from EASM or open the DAST Scanner and select one or more verified assets.

  • Use Quick for a 25-page baseline, Standard for routine 100-page coverage, or Deep for up to 250 pages and depth 3.
  • Add authentication headers or cookies only when the scan needs an authenticated session; values are encrypted and never returned in job responses.
  • Review the selected assets and confirm your authorization before launching.
  • Each target has a 12-minute execution budget and a maximum of two scans may be active per workspace.

Como é o sucesso

Each target has a 12-minute execution budget and a maximum of two scans may be active per workspace.

3

Passo 3

Follow progress and interpret results

Scan History reports queued, crawling, testing, finalizing, completed, warning, failed, and cancelled states.

  • Open a job to review per-target progress, the redacted discovered-URL inventory, successful probes, per-template check coverage, findings, evidence, and remediation.
  • Zero findings are meaningful only when Check coverage shows successful probes. A zero-check scan is marked Completed with warnings and must not be treated as a clean result.
  • Completed with warnings means usable partial findings were retained because one or more targets timed out or failed; review each target warning before treating coverage as complete.
  • Failed jobs show an actionable orchestration or validation error. A job must never remain queued indefinitely; contact support with the job ID if reconciliation marks it failed.
  • Cancel active jobs from Scan History. Late worker results are ignored after cancellation.

Como é o sucesso

Cancel active jobs from Scan History. Late worker results are ignored after cancellation.

Apenas para demonstração

Esta configuração foi concebida para facilitar a utilização. Para implementar clientes de scanner em escala, planeie a sua arquitetura de implementação adequadamente ou contacte-nos para obter as melhores práticas empresariais.

Executar isto

Create a verified-asset scan
curl -X POST "$BLACKSHIELD_URL/api/v1/dast/scans" \
  -H "Authorization: Bearer $BLACKSHIELD_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"config":{"targets":[{"asset_id":"<asset-id>","scheme":"https","base_path":"/"}],"profile":"standard"}}'

Como é o sucesso

  • The EASM asset status changes to Verified on the dashboard, making Deep Scan options available.
  • The job advances beyond queued and reaches a terminal state with per-target outcomes.
  • Authentication values do not appear in job details, findings evidence, or request headers.
Verify Assets and Run DAST Deep Scans | Documentação BlackShield