Capabilities

CyStack VulnScan is not a single check runner. It is a multi-stage scanner that combines attack-surface discovery, service fingerprinting, web crawling, active verification, CVE intelligence, and reporting into one workflow.

Scan Pipeline

Stage	What Happens	Why It Matters
Target normalization	URLs are reduced to domains/IPs where appropriate; CIDR/ranges are preserved.	Prevents duplicate assets and makes license checks consistent.
Scope validation	Domain, wildcard, IP, CIDR, activation, and target-count limits are checked before scanning.	Helps users keep scans inside the purchased and approved scope.
Host discovery	ICMP, TCP ping ports, and range probing identify live hosts.	Avoids wasting time on dead hosts in large scopes.
Port scan	Common TCP ports and configured port sets are tested with rate limits.	Finds exposed services beyond HTTP/HTTPS.
Service fingerprinting	Banners, HTTP metadata, TLS, SSH, SMB, SNMP, CMS and web technology fingerprints are collected.	Enables accurate CVE matching and targeted checks.
Web/API crawling	HTML links, forms, JavaScript paths, common API patterns, OpenAPI/Swagger, GraphQL, and hidden parameters are discovered.	Increases endpoint coverage for modern applications.
Active checks	DAST checks, high-confidence CyStack verification checks, and optional AI-assisted evidence analysis run against discovered endpoints/services.	Finds exploitable classes such as injection, SSRF, exposed panels, weak auth, misconfiguration, and suspicious application behavior.
CVE matching	Concrete CPE/version evidence is matched against the local NVD index.	Detects vulnerable and outdated components without relying only on handcrafted checks.
Enrichment	CVSS, EPSS, CISA KEV, public exploit indicators, CWE, OWASP Top 10, WSTG, and remediation text are added.	Converts raw findings into remediation-ready work items.
Storage and reporting	Results are persisted to the database and exported as CSV, JSON, or PDF.	Keeps Web UI, CLI, history, and reports consistent.

Discovery Technologies

VulnScan uses several discovery techniques in one pipeline:

DNS and passive/active subdomain enumeration.
Live host probing for IP, CIDR, and range targets.
TCP port scanning with configurable rate limits.
HTTP probing for status, redirects, titles, headers, and technologies.
TLS certificate inspection including issuer, subject, SANs, validity window, protocol, and cipher.
WAF/CDN detection and server/provider enrichment.
Service banner grabbing and protocol-specific fingerprinting.
Web crawling with HTML, form, JavaScript path, API route, and common path extraction.
CMS/component discovery for widely used web platforms and extensions.
Optional AI-assisted analysis for endpoint patterns, response anomalies, parameter context, evidence quality, and false-positive review when configured.

Verification Model

VulnScan uses multiple evidence levels:

Verified findings: a check safely confirms the issue with direct evidence.
High-confidence findings: a detector matches strong signals such as exact vulnerable behavior, exposed files, or verified service state.
CPE/CVE findings: a detected product and concrete version match a vulnerable CPE entry in the local NVD index.
Informational findings: metadata such as services, technologies, WAF/CDN, TLS, and DNS context that helps interpret risk.
AI-assisted signals: optional analysis that helps identify suspicious evidence, explain context, and flag findings that may need human validation.

The scanner deliberately avoids broad wildcard version matches because they create excessive false positives. If a product version is unknown or too generic, VulnScan favors not reporting the CVE unless another detector provides stronger evidence.

Database-First Workflow

Standard scans from the Web UI, CLI, or scheduler are persisted to the database. Each scan records:

Asset and target.
Scan source: Web UI, CLI, or scheduled.
Profile and mode.
Authentication configuration type.
Status, phase, progress, start time, completion time, and duration.
Finding counts by severity.
Technologies and discovery metadata.
Findings, evidence, triage state, and report jobs.

This is important operationally: the Web UI is not a separate reporting layer over temporary files. It reads the same scan history that CLI workflows write.

Operational Controls

VulnScan includes controls that matter in production deployments:

License activation and deactivation.
Target scope enforcement for domains, wildcards, IP addresses, and CIDR ranges.
Maximum target and activation limits.
Workspace member roles: admin and member.
Mail providers for notifications: SendGrid API, AWS SES, and custom SMTP.
PDF report jobs that continue after the browser page is closed.
Offline preparation for scanner artifacts and vulnerability intelligence data.

Introduction

Getting started

Vulnerability scanning

WAF — Web Application Firewall

Automation & CLI

Security reference

Administration & operations

Scan Pipeline

Discovery Technologies

Verification Model

Database-First Workflow

Operational Controls

​Scan Pipeline

​Discovery Technologies

​Verification Model

​Database-First Workflow

​Operational Controls

Scan Pipeline

Discovery Technologies

Verification Model

Database-First Workflow

Operational Controls