A scan finds nothing behind login when the scanner never signed in, or when a setting hid the results. Check that the profile has a role, that the success condition matches, that the classes and exploitation phase are on, and that report filters are not too strict.
Why this happens
Four things cause this most often.
- No role. With no roles, the scan is unauthenticated and sees only public pages.
- A failed sign-in. The success condition never matched, so the scanner stayed signed out.
- A narrow scope. Ticked vulnerability classes, an Avoid rule or the exploitation phase being off all reduce what you see.
- Report filters. Minimum severity and Minimum confidence hide lower findings.
How to fix it
- Open the profile. Under Authentication, confirm a role exists. The roles count in Scan Profiles should be above zero.
- Check the Form login, Header or OAuth 2.0 details, and the Success condition.
- Open the scan and the Sitemap tab. Endpoints reached while signed in show a role chip.
- Under Scope, untick classes to scan all, and remove Avoid rules that cover the pages you need.
- Under Reporting, set both minimums to No minimum.
- Save and run the scan again.
Leave Run exploitation phase ticked. With it off, the scan only reads source code and does no live testing.
One more check is the Diff tab. A first scan has nothing to compare, so it shows that there is no previous scan, but later runs show what is new, fixed or regressed. After you fix the sign-in, the next scan should show new findings there.
Still not working?
A clean result can also be true. If the sign-in works and the filters are open, the app may have nothing to report. Read what to check when the scanner cannot get past login, or ask us at /contact.
Related questions
- The scanner isn't getting past my login page. What should I check?
- What does "No auth roles. Add a role to scan behind login, or leave empty for unauthenticated scanning." mean?
- My app doesn't land on a fixed URL after login. How do I set the success condition?
- What is an authentication role?
- How do I run a scan without any login?
How to scan behind login in Cyberlop with authentication roles
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Error still showing?
Send us the exact message and the page you were on. We will reply with the fix.