Today we are thrilled to announce the release of authenticated web application scanning! This new capability allows our customers to expand their use of the Intruder platform to find vulnerabilities which exist behind the login pages of their applications. These scans help to achieve greater coverage and find dangerous flaws which wouldn’t be detected by performing infrastructure checks alone.

With the new release, Intruder aims to deliver a truly comprehensive vulnerability management solution, helping to detect issues not only in the web application layer, but also in the infrastructure on which these web applications are running. This holistic approach makes it much quicker to identify and resolve critical issues, empowering engineering and technical teams to build secure products with ease.

What is authenticated web application scanning and why are we introducing it?

Intruder has always scanned web apps externally from an unauthenticated perspective. It continuously looks for all those security misconfigurations or known vulnerabilities that any opportunistic threat actor could exploit.

While automated attacks targeting your external systems are highly likely to impact you at some point, a more targeted attack that includes the use of credentials cannot be ruled out. If your application allows anyone on the internet to sign up, then you could be exposing your business to malicious characters very easily. What’s more, the functionality available to authenticated users is often more sensitive which means a vulnerability identified in an authenticated part of an application is likely to have a greater impact.

What types of authenticated web application checks does Intruder perform?

Intruder’s dynamic application security testing (DAST) scanner is designed to perform comprehensive reviews across your application, including sections behind your login page in order to identify undocumented vulnerabilities. The scanner is designed to be compatible with a wide range of web application technologies including single-page applications (SPAs) and JavaScript-heavy apps.

The scanning engine will perform numerous web application security checks, going beyond the OWASP top 10 vulnerabilities, by covering server misconfigurations and injection vulnerabilities. This provides the assurance you need over vital functionalities such as account profiles and user-generated content.

Intruder’s web app scanner includes comprehensive checks which will assist in meeting compliance requirements such as SOC 2, ISO 27001 and Cyber Essentials, and help you keep abreast of your application’s threat surface.

How Intruder’s web application scanner helps software developers build secure products?

Intruder offers developers an efficient and reliable solution to resolving vulnerabilities before the software is shipped to the public. Using the Intruder API which easily integrates into CI/CD pipelines, engineering teams can catch bugs introduced with new deployments, ensuring that security keeps pace with software development.

By having a complete overview of application vulnerabilities in a single platform, developers can quickly see what matters the most and, as a result, significantly reduce the likelihood of sensitive data being compromised by threat actors.

Our new authenticated web app scanner encompasses the main benefits that our customers love: ease of use; developer integrations; false positive reduction; straightforward remediation advice; and more. Explore Intruder’s web application features in more detail by visiting our web application scanner page.

How does the licensing work?

Intruder’s authenticated web application scanning comes as an add-on feature to our main scanning service and is available across all existing plans.

This means, that in addition to our Infrastructure Licenses, it is now possible to purchase a separate Authentication License which includes the ability to add authentications to a host.

Get started today

The new authenticated web application scanner is already available for you to try and we’re grateful for feedback to help us improve our product.

Sign up to try Intruder for free for 14 days today and experience the new authenticated web application scanner first hand.

Want to learn more?

Great, get in touch to schedule a demo or send us a message in the chat window, we’d be happy to help.