Web and network security

Tests your running websites and APIs from the outside (DAST), grades TLS and security headers, checks exposed ports and watches your external attack surface (EASM). Included in every plan.

#Step 1: prove you own the domain

DVSentry tests only targets you have proven you control.

1. Open Administration → Domain Verification and add your domain, for example example.com.
2. DVSentry shows a DNS TXT record:

   Type	Name	Value
   TXT	_security-platform-verification.example.com	the token DVSentry shows (a long random string)

   Add it at your DNS provider and choose Verify. DNS can take a few minutes.
3. A proof covers subdomains by default (verification_scope: wildcard). For scans you start, a proof is current for 24 hours; after that choose Verify again (leave the TXT record in place). Scheduled scans re-read the record live before each run.

API equivalent: POST /domains with {"hostname":"example.com"}, then POST /domains/{id}/verify.

#Step 2: register a target

Under Web & Network, add the exact URL and an environment:

• Production or Staging: an https:// URL on port 443. The DNS proof is enough.
• Development: http:// or https:// on any port, for test servers. It needs a second proof: serve the verification value, and nothing else, at http://<host>/.well-known/security-platform-verification, then choose Verify HTTP file.

Optional allowed_paths / disallowed_paths keep the scan inside or out of parts of the site.

Active modes ask an Admin to authorize active scans on the target (POST /web-targets/{id}/authorize-active-scans) and each run to confirm the target is authorized (confirm_authorized_target: true). Private and internal addresses, cloud metadata addresses and redirects to other hosts are always refused, every request is pinned to the address DVSentry resolved, and TLS errors are never ignored.

#Step 3: run a scan

Pick the target and a mode, name the report and run it. Progress shows the current check and the requests sent.

Bounds: timeout_seconds 30-900 (default 300), requests_per_second 1-5 (default 2), max_requests up to 50 (left out = the mode's own budget).

Example through the API (scope scans:trigger):

curl -sS -X POST "$DVSENTRY_URL/v1/web-targets/$TARGET_ID/scans" \
  -H "Authorization: Bearer $DVSENTRY_TOKEN" -H "Content-Type: application/json" \
  -d '{"mode":"passive","timeout_seconds":300}'
# active modes also need "confirm_authorized_target": true

#TLS and compromised certificate authorities

TLS checks grade the served chain and compare it with certificate authorities whose keys are known to be compromised (for example the eMudhra intermediates browsers blocked in October 2026). A match is a critical finding and the TLS grade becomes F.

#Runtime version advisories

The X-Powered-By and Server headers are compared with known-vulnerable runtime versions (PHP, nginx, Apache, OpenSSL, Tomcat, Node.js, lighttpd). A match is "likely vulnerable, confirm with a rescan"; DVSentry never sends an exploit probe.

#Signed-in testing

For role-differential and authenticated api-security, add auth profiles to the target (Admin). Use dedicated test accounts only, never a real customer or production administrator.

A TOTP seed for the test account is stored as a Secret Vault dast_totp_seed entry; it never leaves DVSentry's control plane, and the scanner asks for one 30-second code at a time. Signed-in scans run in an isolated scanner.

#API descriptions

Import an OpenAPI, Postman, HAR or GraphQL SDL description for a target (API specs). DVSentry keeps only endpoint shapes, never values. State-changing checks (POST/PUT/PATCH, never DELETE) need a preview and an Admin's consent bound to that exact list of endpoints.

#External attack surface (EASM)

For a verified domain, Web & Network → External attack surface discovers hosts from DNS, Certificate Transparency (Cert Spotter) and passive DNS (AlienVault OTX), keyless, for that verified root only. Runs record assets, observations and events: new host, certificate changed, new service. It never brute-forces names or scans the internet.

• Run now: POST /organizations/{org}/easm/domains/{domain}/runs. Schedule: PUT .../schedule.
• Runs are metered as network scans.
• Promote a discovered host into a web target (Admin), only under a fresh covering domain proof.

#Schedules

Add a recurring scan per target (POST /web-targets/{id}/schedules from the target page). Each run re-confirms domain ownership with a live DNS lookup first; POST /v1/web-scan-schedules/{id}/run runs one now.

#What DVSentry never does here

Scan a host you have not proven, follow a redirect to another host, reach private or metadata addresses, send DELETE requests, or keep a signed-in test credential in the scanner.

Something missing or unclear? Tell us with Feedback in the app.