Deep profile
Active injection testing in the Deep profile, for verified sites only
The Deep profile is ScanBastion's active-testing scan. It runs everything in Standard and then sends attack payloads, using Nuclei's DAST (fuzzing) templates, into the query parameters and URL paths of the pages the crawl found and of the site's GET forms. It is opt-in, it runs only on sites with a verified proof of control, and you should run it only against sites you own or have written permission to test.
What Deep sends
After the Standard stages, Deep tests each crawled URL with a query string or path segments, and each GET form found on those pages, for:
- SQL injection, error-based: payloads that make a vulnerable query fail with a recognisable database error.
- Reflected cross-site scripting: markup and script payloads that come back unencoded in the response.
- Server-side template injection: template expressions that a vulnerable engine evaluates.
- Path traversal and local file inclusion: sequences that try to read files outside the web root.
- Open redirect: values that make the site redirect a visitor to another host.
- CRLF injection: line breaks that try to add headers to the response.
- Remote file inclusion and XInclude injection.
What Deep deliberately does not do
- No POST forms are submitted, so a scan does not send contact-form messages, sign up accounts or create records.
- No out-of-band callbacks. Nothing is tested that needs the target to call back to a server we control, so blind server-side request forgery and blind command injection are not tested.
- No time-based (sleep) payloads, which tie up database connections and workers on the target.
- No log-in. Authenticated areas are not crawled or tested.
- No headless browser, so DOM-based cross-site scripting, which happens only in the visitor's browser, is not tested.
Why verification is required
Quick and Standard can run on your account's authorization confirmation alone. Deep cannot: every Deep scan needs a verified proof of control of the site, published as a DNS TXT record, a file or a meta tag (see how to verify a domain), and you tick an explicit confirmation each time you start one. Attack payloads against a site you are not authorized to test can be unlawful, and a proof of control is the strongest evidence the site's operator has agreed. The Responsible Scanning Policy applies in full.
Limits
| Profile | Time | Requests | Rate | Pages crawled |
|---|---|---|---|---|
| Quick | 8 minutes | 150 | 1 per second | 25 |
| Standard | 20 minutes | 600 | 2 per second | 100 |
| Deep | 45 minutes | 3,000 | 4 per second | 150, to depth 4 |
As with every profile, the scan stops at whichever limit it reaches first, a stage that did not complete is reported as partial rather than clean, and you can stop it at any point. If a firewall or CDN answers in the site's place, the scan detects it, stops and tells you how to allowlist the scanner.
OWASP Top 10 coverage
| OWASP Top 10 (2021) | Quick and Standard | Deep |
|---|---|---|
| A01 Broken Access Control | No | Partly: path traversal and open redirect |
| A02 Cryptographic Failures | Partly: TLS, certificates, cookie flags | Partly: TLS, certificates, cookie flags |
| A03 Injection | No | SQL injection (error-based), cross-site scripting, template injection, CRLF, remote file inclusion, XInclude |
| A05 Security Misconfiguration | Headers, CORS, error pages; Standard adds exposed files, debug endpoints and panels | As Standard |
| A06 Vulnerable and Outdated Components | Partly: versions visible in responses | Partly: versions visible in responses |
No profile covers A04 Insecure Design, A07 Identification and Authentication Failures, A09 Security Logging and Monitoring Failures or A10 Server-Side Request Forgery, and none tests access control between users. Those need authenticated testing or a manual review.
How findings are graded
Every injection finding is marked Needs review. A template match means the response looked like what a vulnerable application returns; it does not prove the flaw can be exploited, and some applications echo input or print errors harmlessly. Each finding shows the payload that was sent, the parameter or path it went into, and the evidence the template matched in the response, so a developer can reproduce it and decide. The guide Severity, confidence, verification explains how to read the three fields.
What this check cannot tell you
- Flaws reachable only through POST requests, log-ins or JavaScript. They are out of scope by design.
- Blind and time-based vulnerabilities. Without callbacks or sleep payloads, flaws that produce no visible difference in the response are not found.
- Business-logic flaws, such as price manipulation or one user reading another's data.
- That the site is secure. A clean Deep scan means the templates that ran matched nothing. For assurance, commission a manual penetration test.
References
- Nuclei fuzzing (DAST) templates, how they choose where to insert payloads.
- OWASP Top 10 (2021), the categories referred to above.
- Passive vs active scanning, the difference in the traffic a site receives.