Vorpsel / Platform / Exposure
Web Application Scanner
Your websites and web applications are open to anyone on the internet, attackers included. The scanner looks at them the way an attacker would, from the outside, and shows you the vulnerabilities to fix before someone uses them.
At a glance
- Your public websites and the web applications behind them
- The whole site every page and form it can reach, mapped first
- Three layers the server, the platforms and the application you built
- Proven findings reported only when the site's own answer confirms them
- Written permission confirmed by our team before the first scan
Your website is the one door that is open to everyone.
A firewall can close almost everything, but not the site your customers use. Anyone can reach it, and an attacker starts exactly there: reading the pages, trying the forms and looking for the version of something that has a known flaw.
A web application scan does the same, on your behalf. It visits the site from the internet, learns how it is built and tests it for the vulnerabilities attackers look for, so the list of what to fix reaches your team first.
What it looks at
A website is three things stacked on top of each other, and each one can be the weak point. The scanner checks all three in the same run.
The server
The web server that answers every visit and the secure connection in front of it.
Outdated versions, weak encryption settings and certificate problems.
The platforms
What the site is built on: content systems, frameworks, shops and admin panels.
Versions with published vulnerabilities and panels left open to the internet.
Your application
The pages, forms and features your own team wrote, which no vendor will ever patch for you.
Flaws in how the application handles what visitors send to it.
How a scan runs
You give the address of the site. Everything else happens on its own, in this order, and the scan never leaves that site.
Map the site.
Starting at the home page, the scanner follows the links and collects the pages and forms it can reach, the way a visitor would.
Recognize what runs.
It identifies the server, the platforms and their versions, so each part is checked for what is known about it.
Test it.
Every page and form found is tested for the vulnerabilities attackers look for, without disturbing the people using the site.
Report what is proven.
A vulnerability becomes a finding only when the site's own answer confirms it. Guesses never reach your list.
A finding your team can act on
A list of problems is only useful if a developer can open it and fix the first item today. Every finding answers the questions they would ask.
- How serious it is
- A severity, so the team knows where to start.
- Where it is
- The page and the field where it was found.
- The proof
- What the site answered, so nobody has to take it on faith.
- Why it matters
- What an attacker could do with it, in plain words.
- How to fix it
- The change or the update that closes it.
- When it is fixed
- The next complete scan confirms it and closes the finding on its own.
Safe on a live site
Your site onlyThe scan stays on the address you gave and never follows a link to another site. Addresses inside private networks are refused.
With your permissionA new site, or a changed one, is scanned only after our team confirms your written permission for it.
Without disruptionTests that could slow down or change the site stay off unless you turn them on and confirm it.
When to scan
Before a launch
Find the problems of a new site or feature before it is public.
After each release
A change in the code can open a flaw that was not there last week.
On a schedule
Daily, weekly or monthly, so new vulnerabilities in old versions are caught too.
For audits and customers
Show that your websites are tested regularly, with the history to prove it.
Frequently asked questions
Does it test the pages behind a login?
No. It tests what a visitor reaches without signing in, which is also what any attacker on the internet reaches first.
Can it break my site?
Tests that could slow down or change the site are off by default. With them off, the scan behaves like a careful visitor.
How is it different from Network Scan?
Network Scan looks at every port of an address and the services on them. Web Application Scanner looks inside one website: its pages, forms and the application behind them.
How is it priced?
By the number of sites scanned in the month. Talk to our team for a quote.
Related modules
Test your site before someone else does
Enter the site's address and confirm the permission. The first scan runs as soon as our team checks it.