Why doesn't my finding have a screenshot?

Why this happens

The scan's browser takes the screenshot while an exploitation agent proves the issue against the live target. Three things can leave it out:

• Exploitation was off. The profile ran static analysis only, so no browser touched the app.
• The issue was not proven. Findings marked Likely or Unconfirmed may have no live proof at all.
• A page picture adds nothing. Some proof is a raw request and response, such as a missing header. The docs say a screenshot appears "where relevant".

How to fix it

You cannot add a screenshot by hand, so the goal is to find out why the scan left it out and, if that is down to the profile, change the profile before the next run. Start here.

1. Click the finding, then its Evidence tab.
2. Scroll to the bottom. The tab lists the payload, HTTP request, HTTP response, reproduction steps and, when there is one, the screenshot.
3. See the Status on the Summary tab. A Confirmed finding has the most evidence.
4. Open the scan's profile. Under Scope, tick Run exploitation phase if it is clear. It starts on by default.
5. Run the profile again. New proof, if any, shows up.

Still not working?

A missing picture does not make a finding weak. The reproduction steps are ready-to-run curl commands, so you can prove the issue yourself without a picture. See how to reproduce a finding. If nothing in the scan is Confirmed, read why findings are not proven. Still unsure? Contact us. The tutorial on reading a finding covers each tab.

Related questions

• Where do I find the screenshot captured as evidence?
• How do I reproduce a finding myself?
• Why aren't any of my findings marked Confirmed?
• What does the exploitation phase do?
• How do I turn off the exploitation phase?

Full tutorial

How to read a finding in Cyberlop: Summary and Evidence

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre