What is web scanning?¶
The practical answer¶
Web scanning is automated or manual activity used to identify pages, directories, files, technologies, versions, vulnerabilities or misconfigurations in a web application.
The key evidential caution¶
The dangerous assumption is that scanning proves an offender gained access.
It does not.
Security teams, search engines, monitoring services and researchers also scan websites.
Web scanning may look for:
Key points¶
- administrative pages
- backup files
- exposed directories
- software versions
- login portals
- API endpoints
- known vulnerabilities
- default files
- misconfigured storage
Evidence to preserve¶
Investigators should preserve:
Key points¶
- source details
- request paths
- timestamps
- user-agent or tool indicators
- response codes
- response sizes
- authentication attempts
- the sequence of requests
- what activity followed
A broad pattern of requests may show reconnaissance.
A single request to a sensitive path may be accidental, automated or deliberate.
Evidential limits¶
Do not assume that a successful response code proves the requested content was sensitive or accessed fully.
Likewise, repeated failed requests may still show preparation or target selection.
Compare the activity with known vulnerability scanning, penetration testing, search-engine indexing and provider monitoring.
The source IP address may represent a scanner service, cloud host, proxy or compromised system.
Scanning may also be opportunistic rather than specifically targeted. Large-scale automated tools test many websites for the same weakness. That pattern may explain the method without proving prior knowledge of the victim. Preserve enough surrounding requests to distinguish broad internet scanning from focused reconnaissance against one application.
Also record whether scanning changed after a successful response. Focused follow-up against one discovered path may support deliberate target selection more strongly than repeated generic probes.
Operational takeaway¶
Treat web scanning as reconnaissance, and distinguish discovery of an endpoint from successful authentication, exploitation or data access.