A scan runs five phases in order: pre-recon (read the source), recon (map the live app into a sitemap), vulnerability analysis (eight specialists work in parallel), exploitation (prove issues in a real browser, optional) and reporting (assemble the report).
The short version
Each phase builds on the one before it. The run is durable, so it can recover if something fails part-way, and you can leave the page while it works.
How it works in Cyberlop
- Pre-recon (source analysis). One agent reads the cloned repository. It builds a baseline of frameworks, entry points, data flows, trust boundaries and the authentication model.
- Recon (mapping the live app). An agent maps the live app into a sitemap: endpoints, methods, parameters and the authentication each needs. The sitemap ties a finding to a URL.
- Vulnerability analysis. Eight specialists work in parallel, each in its own lane. They cover injection, XSS, auth, authz, SSRF, crypto, config and business logic. Each one lists hypotheses with an exact file and line.
- Exploitation. For each hypothesis, an agent tries to show the issue safely against the live target, using a real browser. It captures the request, the response, the payload and sometimes a screenshot. Findings are graded Confirmed, Likely or Unconfirmed.
- Reporting. A final agent writes the report from confirmed findings. It applies the profile's minimum severity and confidence, and any report guidance.
Two settings change this flow. If you untick Run exploitation phase in the profile, phase four is skipped and the scan is analysis only. A black-box scan has no source, so it works from the live URL alone.
A typical scan of a small app takes roughly an hour. Rate limits slow a scan down. They do not make it fail.
What to do next
- Choose the classes and the exploitation switch in a profile. See the first scan guide.
- Read how findings merge in the in-app Documentation under Findings & accuracy.
- Learn about DAST and SAST.
You will see the phases at work in the app. The sitemap on a scan fills in during recon, findings arrive during analysis and exploitation, and the downloadable PDF is the result of the last phase.
Questions about a phase? Contact us.
Related questions
- What is Cyberlop and what does it test?
- Does Cyberlop use a real browser when it tests my app?
- What's the difference between a target, a scan profile and a scan?
- Where do I find the built-in documentation and step-by-step walkthrough?
- How do I go from a fresh sign-in to my first finished report?
Getting started with Cyberlop: from sign-in to your first finding
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.