Reviewing scan results

The Scans page provides a list of all scans performed, including information about the scan profile, the time and date when the scan was performed, a count of vulnerabilities found for each severity level, and the current status of each scan. An API tag is shown on findings that we can attribute to API specs. API specs can come from manual uploads to a target/scan configuration, linked to a target/scan configuration, or linked from API Discovery.

From the Scans page, you can access the results of each scan which are displayed on the Scan Details page. This document provides high-level information about the Scan Details page and the information you can review there.  

Accessing scan results

When a scan is complete, Acunetix emails you a summary of the results and a link to access the scan results directly. You can also access the scan results by following these steps in Acunetix:

1. Select Scans from the left-side menu.
2. Click on the target for the relevant scan on the Scans page.

3. The Scan Details page opens. Use the tabs to view the scan results information.

Viewing Scan Details

The Scan Details page provides information about the scan results, grouped under six tabs. Each tab is explained below.

Scan Summary 

The Scan Summary tab provides an overall threat level rating for the target based on the number and severity of vulnerabilities discovered by the scanner. It also displays the number of open vulnerabilities by severity, a summary of the scan parameters and activities during the scan, and the most vulnerable technologies detected on the target.

Vulnerabilities

This is the list of detected vulnerabilities, ordered by severity. You can filter the information by severity, status, and target type. For example, you may choose to view only Critical and High severity vulnerabilities with a status of ‘Fixed’. On the right-hand side, you have the option to change which columns are displayed. Click on a vulnerability from the list to view all information about the detection and to change the vulnerability status.

Runtime SCA Findings

On this tab, you can view a list of technologies used by the scanned target that have been identified as out of date. Out-of-date technologies are not considered active vulnerabilities (you will not find them in your vulnerabilities list) but rather items of interest picked up by the scanner that may pose a risk to your target due to using an older version of the technology. Click on a technology from the list to view more information about the detection and the recommendation to address it.  

Site Structure

Use this section to check that the scan has covered all parts of your target and to identify vulnerabilities affecting a specific file or folder. Click on a folder to expand the site structure tree and display the vulnerabilities detected in that part of your target. You can also click on a vulnerability to show more information about the attack details, impact, and how to fix it.

Scan Statistics

This tab provides two data tables that you can sort by number of runs/requests or by total duration.

• Operations: This table analyzes the different scan operation types that were performed, showing the number of times each scan operation was run, the average duration of each operation, and the total duration of all the operations.
• Locations: This table analyzes the different URLs that were scanned, showing the number of times each URL was accessed, the average duration of each scan, and the total duration of all the scans performed on that location.

Activity

The Activity tab provides a list of the scan events, showing when the scan started and completed, and if any errors were encountered during the scan. Click on an item to reveal more details about the scan event.

Vulnerabilities Detected by AcuMonitor

An Acunetix scan uses AcuMonitor to detect certain vulnerabilities, such as Blind XSS, Email Header Injection, and certain types of SSRF, XXE, and Host Header Attacks. However, AcuMonitor can only detect some of these vulnerabilities after the scan has finished. When this happens, AcuMonitor will update the scan results with the new vulnerabilities detected, and you will receive an email notifying you that the scan results have been updated. For more information about AcuMonitor, refer to AcuMonitor Technology.