Package: Invicti AppSec Core (on-demand)
Configure target scan inputs
Focus DAST scans on the assets that matter by supplying API specifications and supporting files for each target. This document explains how to upload scan inputs on the target's Scan configuration tab and restrict scans to those imported sources when needed.
Open the page before you make these changes:
- From the left-side menu, select Inventory > Targets.
- In the targets list, select the target you want to update.
- On the target details page, select Scan configuration.
- Locate the API specification and Imported files sections.
Why this matters
Without input files, scanners rely only on crawler discovery and can miss API-only paths or hidden routes. Importing specifications and files gives the scanner explicit paths to test. Restricting scans to imported sources helps you keep testing tightly scoped when broad crawling isn't allowed.
Add API specifications for explicit API coverage
In the API specification section, upload or link one or more API specs:
- Click Upload specification to upload a local API description file.
- Click Link from URL to import an API specification from a hosted URL.
Once you add specs, the section displays a list of the specifications associated with the target.
Add project files to improve path discovery
In the Imported files section, click Upload file to add files that help define application structure and routes.
Use this when your application has paths that aren't easily discoverable through crawling alone.
Keep scans limited to imported sources when needed
Use Restrict scans to imported files and API specifications when your policy requires controlled scope.
- Set Yes when scans must stay within uploaded files and imported API specs.
- Set No when you want the scanner to use imported inputs and broader crawling together.
How restrict mode affects crawl behavior
When you import a file and toggle Restrict scans to imported files and API specifications, the crawler behaves differently:
- Yes (restricted): The crawler scans only the paths listed in your imported files and API specs, ignoring all other parts of the target.
- No (unrestricted): The crawler crawls the target as usual and uses the imported files to add additional paths (including paths that aren't linked from the main target).
Example scenario:
If you create a target with the URL http://www.example.com and import a .txt file containing these paths (one per line):
http://www.example.com/main/sub1/
http://www.example.com/extra/sub3/
Then the following behavior occurs:
| Restrict scans | Crawls and scans | Doesn't crawl and scan |
|---|---|---|
| Yes | /main/sub1/ and /extra/sub3/ | / (root), /main/sub2/, /extra/sub1/, /new/ |
| No | / (root), /main/, /main/sub1/, /main/sub2/, /extra/, /extra/sub1/, /extra/sub3/, /new/ | (all reachable paths are scanned) |
Click Save target configuration to apply changes.
Accepted file formats
You can add paths to a target using the following file types:
API specifications
| Format | File extension | Use case |
|---|---|---|
| OpenAPI / Swagger | .json, .yaml, .yml | Describe RESTful APIs |
| GraphQL Schema/Introspection | .graphql, .json | Define GraphQL API structure |
| RAML | .raml | Describe RESTful APIs |
| Web Application Description Language (WADL) | .wadl | Describe RESTful APIs |
| Web Services Definition Language (WSDL) | .wsdl | Describe SOAP web services |
Imported files
| Format | File extension | Use case |
|---|---|---|
| ASP.NET Project Files | .csproj, .vbproj | Extract routes from compiled projects |
| Burp Saved Items | .xml | Import session or scan results |
| Fiddler Session Archives | .saz | Import captured HTTP sessions |
| HTTP Archives | .har | Import traffic captured in browsers or tools |
| Selenium | .html, .side | Import recorded test scenarios |
| Postman OpenAPI | .json | Import API collections |
| Generic file list | .txt | Lists of URLs (one per line) |
Invicti AppSec Core doesn't currently support multiple related API files with dependencies or links between them. Import each API specification separately.
Troubleshooting
Imported specification doesn't appear in the list
Refresh the page and confirm the import completed successfully. If the file is malformed or unreachable from the provided URL, the list won't update. Re-upload the file or verify the URL and try again.
Scanner still tests paths outside uploaded inputs
Confirm Restrict scans to imported files and API specifications is set to Yes and click Save target configuration. If it's already enabled, verify the extra paths aren't explicitly included in the imported specification content.
Need help?
Invicti Support team is ready to provide you with technical help. Go to Help Center