Step 1: Add Targets

The first step of vulnerability management is to add the URLs for which you want Scrut to run DAST (Dynamic Application Security Testing) scans.

Step 1: Navigate to Vulnerabilities → Targets

1. Sign in to Scrut and go to Vulnerabilities → Targets using the left sidebar.
2. Click the Add Target button at the top-right of the page.

Step 2: Enter the Target URL

Enter the URL of the website, web application, or code repository you want to scan for vulnerabilities. Enter the full URL of the target domain, such as: https://app.example.com.

Note: The URL must not have a trailing slash.

Step 3: Set Scan Frequency

Choose your desired scanning schedule from:

• On-Demand: Run a scan ad hoc whenever you need to
• 3 days: Schedule a scan once every three days
• Weekly: Schedule a scan once every week
• Monthly: Schedule a scan once every month

Step 4: Select the Scan Mode

Choose your preferred scan mode from:

• Quick Scan: A rapid, non-intrusive scan. Ideal for continuous monitoring, especially in sensitive production environments.
• Full Scan: A more intrusive and in-depth scan that simulates attacks by sending crafted requests and analyzing responses to identify weaknesses. May alter or modify data. Scrut recommends running this only in staging and other lower environments, and not in your production environment.

Step 5: Configure the Authentication Mechanism

Choose the appropriate authentication mechanism for your target. This is crucial for enhanced scan coverage and access to protected areas. Options include: None, Cookie, Token, and Credentials.

1: None

Choose this option to perform an unauthenticated scan.

2: Cookie

Select this option when authentication is handled through a specific cookie rather than a standard login form. You'll need to enter the following details:

• Cookie Name: The name (key) of the cookie used for authentication (e.g., sessionid, auth_token)
• Cookie Token: The cookie value.

3: Token

Choose this authentication mechanism when the application or API requires an authentication token with each request, typically in the HTTP headers. It is common for APIs to use OAuth 2.0 bearer tokens, JWTs, or custom API tokens. You will have to enter the following details:

• Token Type: Defines how the token will be sent, such as:
  • Bearer (OAuth 2.0 standard)
  • JWT (JSON Web Token)
  • API key (Custom)
• Token Value: The actual token string provided by your authentication system.

4: Credentials (Form-Based)

Enter the following details:

• Username and Password: The scanner will use these credentials to log into the application.
• Login Path: The URL of the login form. You can obtain the login path by attempting to log in from the target URL. For example, the login path for Scrut is https://app.scrut.io/.
• Logged-in Indicator: A mechanism used to determine whether the scanner has successfully authenticated a user with the above credentials. You can leave it as the default value.

Step 6: Save the Target

Once you add values for all fields, click Save to add the target.

FAQs & Troubleshooting