Nederlands
A scan sensor is an agent temporarily installed in the runtime of your application, allowing our pentesters to detect vulnerabilities that are difficult or impossible to find without it. The sensor combines external black-box scanning with internal runtime feedback, resulting in significantly more relevant findings with fewer false positives.
What is a scan sensor
The scan sensor is an agent placed non-destructively in the test environment of your application. While our pentesters simulate external attacks, the sensor measures in real time how your application responds internally: which functions are called, which SQL queries are executed, which files are accessed. This technology is known in the industry as Interactive Application Security Testing (IAST).
Difference with traditional scan techniques
- Black-box scanning (DAST). Simulates external attacks without insight into the code. Detects vulnerabilities from the outside but lacks context of how the application responds internally.
- Source code analysis (SAST). Static analysis of code without execution. Detects code patterns but does not understand how the application actually behaves during an attack.
- Scan sensor (IAST). Combines external attack simulation with internal runtime observation. Most complete detection because both perspectives are combined.
Concrete advantages during a pentest
Precise vulnerability location
The sensor reports the exact code line causing the vulnerability, including the complete stack trace and involved SQL query. This significantly accelerates remediation because your development team immediately knows where to patch.
Fewer false positives
Because the sensor measures the actual response of your application, findings are automatically verified. External scanners frequently report potential vulnerabilities that are not exploitable; the sensor filters this out of the report.
Deeper SQL injection detection
Traditional black-box scanners only detect SQL injections if database errors are displayed or through specific known techniques. The sensor detects SQL injection in all types of queries, including INSERT statements and second-order injections where the payload is executed later.
Detection of configuration flaws
Insecure configurations only visible during runtime are detected. For example: if custom errors in .NET are disabled, sending stack traces to end users, the sensor sees this immediately.
Complete inventory of input points
The sensor builds a list of all possible input points in your application based on actually intercepted input, rather than relying on crawling. This finds input points only reachable after login, behind workflows or through JavaScript routing.
File operations and backdoor detection
The sensor tracks file access within the application. Hidden or unknown files (for example backdoors placed by attackers) become visible. Vulnerabilities for arbitrary file creation or deletion are also detected.
Email injection detection
The sensor measures interactions with email-sending functions, revealing injection vulnerabilities in email forms. This prevents attackers from abusing your application for bulk sending of spam or phishing.
Support for SEO-friendly URLs
For applications with URL rewriting (for example /product/abc-123 instead of /product.php?id=123), no separate scan rules need to be configured. The sensor recognizes the rewrite dynamically.
When we use a scan sensor
We consider a scan sensor for:
- Complex web applications with substantial business logic
- Applications where false-positive tolerance is low (compliance audits, medical systems)
- Applications with many input points behind login flows
- Situations where deep remediation context is valuable for the development team
The scan sensor is available on request and fits larger pentest scopes. This is discussed during the scoping conversation.
Learn more about our pentest approach? Contact us for a complimentary scoping conversation, or view our pentest packages.