Advanced Settings
When launching a scan, the Checks and Advanced tabs let you fine-tune what runs and how aggressively. Which tabs and fields you see depends on the scan type.
Checks tab (vulnerability scans)
Every category and check is enabled by default. Uncheck a category to exclude it entirely, or expand it to deselect individual checks. Search to find a specific check by name.
| Category |
|---|
| Discovery |
| Known CVEs |
| CISA Known Exploited Vulnerabilities (KEV) |
| Misconfiguration |
| Exposed Admin Panels |
| Default Credentials |
| Information Exposure |
| IoT |
| SQL Injection |
| Cross-Site Scripting |
| Server-Side Request Forgery |
| Local File Inclusion |
| Remote Code Execution |
| Server-Side Template Injection |
| Denial of Service |
| Subdomain Takeover |
| TLS/SSL |
| Fuzzing |
| Brute Force |
| Intrusive |
| Miscellaneous |
Intrusive checks actually execute the exploit proof-of-concept against the target, rather than just passively detecting the vulnerability. Only enable this category if you understand the risk of running live exploits against your targets.
Advanced tab, vulnerability scans
Host Discovery
Probe hosts to confirm they're alive before scanning, instead of scanning every target blindly.
| Field | Description | Default | Range |
|---|---|---|---|
| Enable Host Discovery | Probe hosts to confirm they're alive before scanning, instead of scanning every target blindly. | Off | — |
| TCP SYN Ping / ICMP Echo Ping | Ping method used to detect live hosts. | TCP SYN Ping on, ICMP Echo Ping off | At least one of TCP or ICMP must be enabled if host discovery is on |
| Discovery Ports | Ports probed during the TCP ping. | — | Each entry must be a valid port or port range (1–65535) |
| Discovery Rate (packets/sec) | Maximum discovery packets sent per second. | 1000 | 0–10000 |
Performance & Reliability
Control how aggressively the scan runs and how it handles unresponsive hosts.
| Field | Description | Default | Range |
|---|---|---|---|
| Requests per Second | Maximum requests sent per second across all targets. | 150 | No server-enforced maximum |
| Retries | Number of times to retry a request after a network failure. | 1 | 0–10 |
| Max Host Errors | Skip a host after this many consecutive errors. | 30 | 0–1000 |
| Scan Timeout | Maximum total duration for the scan (e.g. 30m). | Unset (no limit) | Go duration string (e.g. 30m, 1h) |
| Network Timeout | Maximum time to wait for a single request to respond (e.g. 5s). | 5s | Go duration string (e.g. 5s) |
| Scan Order | By Target finishes one target at a time — good for getting full results per host quickly. By Check runs one check across every target before moving on — good for surfacing one vulnerability class fleet-wide fast. | By Target | — |
| Concurrent Targets | Number of targets scanned at the same time. | 25 | 1–500 |
| Concurrent Checks per Target | Number of checks run at the same time against a single target. | 25 | 1–500 |
| Max Response Size (MB) | Responses larger than this are truncated before checks inspect them. Set to 0 for unlimited. | 10 | 0–100 |
Custom Headers
Sent with every HTTP request — useful for auth tokens or bypassing WAF rules tied to a specific header. Add any number of header name/value pairs.
Advanced tab, discovery scans
| Field | Description | Default | Range |
|---|---|---|---|
| Service Discovery | Which ports to scan for open services. Scanning fewer ports is faster. Options: Selected Ports (Custom), Top 100 Ports, Top 1000 Ports, All Ports (Slow). | — | One of 100 / 1000 / full / custom port list |
| Ports (custom) | Select ports or port ranges to scan (e.g. 80, 3000-4000). Only used when Service Discovery is set to Custom. | — | Each entry must be a valid port or port range (1–65535) |
| Verify Open Ports | Double-check each open port to filter out false positives. | Off | — |
| Enable Banner Grabbing | Capture service banners (e.g. server name and version) from open ports. | Off | — |