Web and API testing (DAST)
Cerberon tests running web applications and REST APIs without source code. The Cerberon Agent exercises the target with real tools and reports each finding with its evidence. A request that could not connect is recorded as not tested, never as a finding.
Start a web or API scan from New Scan > Web & API (DAST).
| Mode | What runs | Authentication |
|---|---|---|
| Scanner | The planned scanners only. | Not available |
| Scanner + Agent (recommended) | The scanners, then the agent. The scanner phase can be skipped. | Available |
Targets
Section titled “Targets”| Input | Format | How it is used |
|---|---|---|
| Web application | http:// or https:// address |
The agent crawls and tests the application. |
| OpenAPI or Swagger | JSON or YAML | The documented endpoints become the work list. |
| Postman collection | v2.1 or v1 JSON | The requests and variables become the work list. |
| HAR file | Recorded browser session | The captured requests become the work list. |
An API collection can be up to 16 MB. It describes the API but does not widen the scope. Hosts named inside it are rewritten to the base address you submit.
How a scan runs
Section titled “How a scan runs”| Phase | What runs |
|---|---|
| Discover and fingerprint | Identifies the server, frameworks and live endpoints. |
| Web server and TLS | Checks protocols, cipher suites and certificates. |
| Template scan | Vulnerability templates check for known CVEs, exposures and misconfigurations. |
| Crawl and active scan | A crawler maps the application and an active scanner tests what it finds. |
| Agent testing | The Cerberon Agent reads every tool’s output, then tests each function or endpoint itself with HTTP tools, content discovery and, when exploitation is permitted, injection tools. |
Scanner mode stops after the tool phases. In Scanner + Agent mode you can skip the tool phases and start the agent straight away.
What the agent tests
Section titled “What the agent tests”The method is the OWASP Web Security Testing Guide (WSTG) v4.2: all 98 tests across its 12 categories, from information gathering, configuration, identity, authentication, authorisation and session management to input validation, error handling, cryptography, business logic, client-side and API testing.
- Web applications. Crawling, client-side JavaScript bundles and source maps, input handling, authentication and access control. Findings map to the OWASP Top 10 2025.
- APIs. Token and authentication handling, object and function level authorisation, injection, excessive data exposure and rate limiting, including GraphQL. Findings map to the OWASP API Security Top 10 2023.
Each finding carries the evidence behind it and, when it came from an HTTP request a tool sent, a curl command that reproduces it.
Authenticated scans
Section titled “Authenticated scans”Authentication needs Scanner + Agent mode.
| Option | How it works |
|---|---|
| None | Tests without signing in. |
| Session cookie or storage state | Paste a cookie header or a browser storage-state JSON. |
| Username and password | The agent signs in with them. |
| Log in with a browser | Open the recorder, sign in by hand (MFA and CAPTCHA work), then select Capture Session. The session is held on the server. |
To test as several roles, put a Role: <name> line before each identity’s session material. Each finding names the role it was found with.
A recorded session is bound to the address it was captured on, and the recorder’s browser is closed after 30 minutes. If the agent sees a signed-out page mid-scan, it records SESSION EXPIRED and stops authenticated testing.
For a scheduled scan, save the authentication as a profile on the Schedule step. The schedule stores the profile reference, never the session or password.
Coverage
Section titled “Coverage”Each function or check is marked tested, not applicable or blocked, with a reason and evidence where required. A required check with no outcome, or a tested check with no evidence, makes the scan incomplete rather than clean. The report states coverage as one figure, for example “42 of 57 applicable cases were covered”. The per-case detail stays in the console.
Scope and safety
Section titled “Scope and safety”- Scope. The submitted host is the boundary. Subdomains, other addresses and hosts found in links or schemas are out of scope unless you list them under Other hosts in scope. Out-of-scope hosts are recorded and not tested.
- Vulnerability Assessment Only. The scan does not exploit, run denial of service, brute force, stuff credentials or exfiltrate data.
- Without that option, the scan is a penetration test. Exploitation is permitted and the report says so.
- Rate. Each scan can set crawl depth (0 to 20) and requests per second (up to 1,000).