Which OWASP Top 10 categories does the web scan actually check?
Coverage centres on the classes the shipped scanners handle — injection (SQL and others), cross-site scripting, CSRF, SSRF, security-misconfiguration and TLS/header weaknesses, plus Nuclei templates for known CVEs. Every finding is tagged to its OWASP Top 10 (2021) category so the report reads as a methodology, not a raw dump.
Already live in the product
This engagement can align with shipped product capabilities in your tenant workspace.
Included in the Infronest workspace
These capabilities ship in the product today—consulting adds human validation and attestation where required.
- Automated web scanning
What you get
Delivered with AI-assisted engineering and human review on architecture, security, and production readiness.
- Scoped engagements with allowed_hosts
- Quick, full, and Nuclei scan profiles
- HTTP Lab and manual findings
- Analyst workbench triage
- Engagement HTML + PDF reports
- Authenticated session and API coverage
What teams can do here
- Step 1Scope engagement
- Step 2Run scan profile
- Step 3Lab or import findings
- Step 4Report and re-test
How it works
- 01
Define scope and auth
Set the target hosts in the engagement allowlist and supply how to reach logged-in areas — bearer token, basic, form or cookie session — so testing is not limited to public pages.
- 02
Crawl and scan
The crawler maps the app, then scanners for SQL injection, XSS, CSRF, SSRF, TLS and security headers run under the quick, full or Nuclei-template profile. Findings map to the OWASP Top 10 (2021) with CVSS 3.1 scores.
- 03
Verify high-impact findings by hand
An analyst reproduces critical and high findings in the scoped HTTP Lab, attaches request/response evidence, and marks anything unconfirmed as a false positive with a documented reason.
- 04
Report and re-test
Export an engagement report in HTML or PDF, then re-scan after fixes ship so you can show what was closed. Certified human validation is available as an add-on for audit sign-off.
A worked example
Say a D2C retailer points a full scan at its staging checkout — roughly 120 crawled pages behind a form login. The scanner raises a SQL-injection indicator on the search parameter and a reflected XSS on an error page. An analyst replays both in the HTTP Lab: the injection reproduces with a database error captured as evidence, the XSS is mapped to OWASP A03, and a third alert turns out to be a WAF echo and is closed as a false positive with the reason recorded. Fixes ship within the sprint, the re-scan confirms closure, and the delta goes to the payments partner.
Frequently asked questions
See also: VAPT product hub · API penetration testing · Web app pentest checklist (blog) · What is penetration testing? (blog) · Book a demo
Mobile application security testing (APK / IPA)
Learn more
API penetration testing for REST, GraphQL & microservices
Learn more
Network penetration testing, internal and external
Learn more
Cloud penetration testing for AWS, Azure and GCP
Learn more
Continuous security scanning on every commit and deploy
Learn more
Remediation support and retests that prove fixes held
Learn more
Ready to put your web app through a real assessment?
Scoped crawling, OWASP-mapped findings and hand-verified highs in one exportable report — before a partner review or pen-test questionnaire forces the timeline.
