Quickstart: URL scan (DAST)

Point Pencheff at a live URL and get a verified, exploit-first assessment with OWASP Top 10 mapping. Every scan runs the full Deep assessment (~60+ min). The same engine drives the SaaS dashboard, the CLI, and the MCP tools — pick whichever surface matches your workflow.

⚠️

Authorization is mandatory. Every scan API call carries a consent_payload. Run only against systems you own or have written permission to test. Pencheff will refuse to scan otherwise.

1. Pick a target

Every scan runs the full Deep assessment, so there’s no profile to choose — just point Pencheff at the surface you want tested:

Scenario	What to point at	Notes
Public marketing site	`https://acme.com`
Production web app	`https://app.acme.com`
API behind a token	`https://api.acme.com/v1`	add an auth header
Stage / pre-prod, exhaustive sweep	`https://stage.acme.com`
Single-page app / SPA	`https://app.acme.com`	Playwright crawl auto-engages

2. Run it

Open app.pencheff.com, sign in, click Register target.
Paste the URL, optionally add credentials, scope, and exclude paths.
Click Start scan — every scan runs the full Deep assessment (no profile to pick), and you’ll be redirected to a live progress page. Stages stream over SSE.
When it finishes, browse findings by severity, OWASP category, or compliance framework.

# Every scan runs the full Deep assessment — auto-creates an
# engagement, persists a DREAD threat model, and runs the full
# attack-chain phase. --profile is optional.
pencheff scan \
  --target https://example.com \
  --save-history \
  --output ./reports/
 
# Fail the build on any HIGH+ finding.
pencheff scan \
  --target https://example.com \
  --fail-on high \
  --format json,docx \
  --output ./reports/
 
# Authenticated scan — credentials never leave the local machine.
pencheff scan \
  --target https://app.example.com \
  --username [email protected] \
  --password "$APP_PASSWORD"

> Pentest https://juice-shop.herokuapp.com

I'll run a full Deep scan now.

The MCP host fans the request out across the canonical tool order:

pentest_init — new session
check_dependencies — see which external tools are detected
recon_passive → recon_active → recon_api_discovery
scan_waf → payload_generate
scan_injection → test_endpoint (manual exploitation)
scan_client_side → scan_auth → scan_authz → scan_advanced
exploit_chain_suggest → test_chain
generate_report and the chosen exporter

3. Read the result

Findings appear in the unified queue with severity, CVSS v3.1 + v4.0, OWASP category, and compliance fan-out.
Every finding flagged by a scanner is followed up by test_endpoint — the report contains only true_positive rows by default.
Every scan attaches a STRIDE / DREAD threat model and a compliance rollup.
The DOCX report carries an executive summary, the findings register, the compliance appendix, and the threat model.

Common gotchas

Cloudflare / WAF returns 403. Add the WAF’s session cookie via the dashboard’s Headers row on the target. scan_waf will detect and tag the WAF; payloads adapt automatically.
SPA returns a blank shell. No action needed — every scan runs Deep, which triggers the Playwright crawler alongside the fast HTTP crawler.
Rate-limited target. Use the dashboard’s Throttle card on the target to cap requests-per-second; the engine slows every dispatcher.
Auth flow is not OIDC. Record a login macro once via the dashboard’s Authentication card; the macro attaches to the target and replays on every scan.

Tutorial: end-to-end web app — same flow with auth, exclusions, and a customer-ready DOCX.
Compliance mapping — turn the scan into audit evidence.
CI/CD integration — gate every PR.

Overview LLM red team

Quickstart: URL scan (DAST)

1. Pick a target

2. Run it

3. Read the result

Common gotchas

Next