> ## Documentation Index > Fetch the complete documentation index at: https://pentest-tools.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Get scan information by ID > Get scan information by ID. For the output, see `/scans/{id}/output` ## OpenAPI ````yaml https://api.pentest-tools.com/api-schema.yml get /scans/{id} openapi: 3.0.3 info: title: pentest-tools.com REST API version: 1.0.1.1 servers: - url: https://app.pentest-tools.com/api/v2 security: - bearerAuth: [] tags: - name: targets x-displayName: Targets description: Operations done on Targets - name: scans x-displayName: Scans description: Operations done on Scans - name: workspaces x-displayName: Workspaces description: Operations done on Workspaces - name: http_loggers x-displayName: HTTP Loggers description: Operations done on HTTP Loggers - name: wordlists x-displayName: Wordlists description: Operations done on Wordlists - name: finding_templates x-displayName: Finding Templates description: Operations done on Finding Templates - name: vpn_profiles x-displayName: VPN Profiles description: Operations done on VPN Profiles - name: findings x-displayName: Findings description: Operations done on Findings - name: reports x-displayName: Reports description: Operations done on Reports paths: /scans/{id}: parameters: - name: id in: path description: id of scan required: true schema: type: integer get: tags: - scans summary: Get scan information by ID description: Get scan information by ID. For the output, see `/scans/{id}/output` operationId: get_scan_status responses: '200': description: OK content: application/json: schema: type: object required: - data properties: data: $ref: '#/components/schemas/Scan' '401': $ref: '#/components/responses/UnauthorizedError' '403': $ref: '#/components/responses/ForbiddenError' '404': $ref: '#/components/responses/ObjectNotFoundError' '429': $ref: '#/components/responses/TooManyRequestsError' '500': description: Internal server error components: schemas: Scan: type: object additionalProperties: false properties: id: type: integer readOnly: true tool_id: type: integer target_id: type: integer description: only one of `target_id` and `target_name` should be used target_name: type: string nullable: true writeOnly: true description: only one of `target_id` and `target_name` should be used workspace_id: type: integer nullable: true writeOnly: true description: >- Workspace where the scan is started. It has to match the workspace ID of the target vpn_profile_uuid: type: string nullable: true writeOnly: true description: >- VPN profile to use for the scan. If null, there will be no VPN profile used. If not specified, the profile attached to the workspace will be used. status_name: type: string enum: - running - finished - failed to start - stopped - timed out - waiting - aborted - VPN connection error - auth failed - connection error readOnly: true vpn_scan: type: boolean readOnly: true max_scan_time: type: integer minimum: 1 maximum: 1440 default: 1440 writeOnly: true description: >- Maximum number of minutes that the scan should run. Not supported by: Sniper, tools with short scan duration (like Website Recon or ICMP Ping). report_callback: type: object description: >- Send the report in a specific format to this URL when the scan finishes writeOnly: true properties: url: type: string format: url description: Send the report to this URL when the scan finishes format: type: string description: Send the report in a specific format default: raw_status enum: - raw_json - raw_status - pdf_report required: - url progress: type: integer minimum: 0 maximum: 100 readOnly: true description: Current progress of the scan result_summary: type: object nullable: true readOnly: true properties: text: type: string nullable: true description: >- A text description of the summary. Present for discovery scanners critical: type: integer nullable: true description: >- Number of critical risk vulnerabilities. `null` for discovery scanners high: type: integer nullable: true description: >- Number of high risk vulnerabilities. `null` for discovery scanners medium: type: integer nullable: true description: >- Number of medium risk vulnerabilities. `null` for discovery scanners low: type: integer nullable: true description: >- Number of low risk vulnerabilities. `null` for discovery scanners info: type: integer nullable: true description: Number of informational findings. `null` for discovery scanners start_time: type: string format: date-time readOnly: true end_time: type: string format: date-time nullable: true readOnly: true description: End time of the scan. `null` if the scan is not finished duration: type: integer readOnly: true description: Duration of the scan in seconds num_tests: deprecated: true type: integer readOnly: true description: > This field is deprecated and will be removed in a future version. Use `/scans/{id}/tests` instead. Number of tests run by the scanner. Always `1` for discovery scanners. num_finished_tests: deprecated: true type: integer readOnly: true description: > This field is deprecated and will be removed in a future version. Use `/scans/{id}/tests` instead. Number of currently finished tests. This should be equal to `num_tests` for successfully finished scans. status_message: type: string nullable: true readOnly: true description: >- Message describing the current status of the scan. This is `null` if the scan is not currently running. info_text_lines: type: array items: type: string readOnly: true description: >- Informational messages about the scan as a whole, such as a warning that the host may be down or blocked by a firewall when no open ports were found. Empty when there are no messages. scan_original_url: type: boolean default: false writeOnly: true description: > If `true`, the original URL is passed to the scanner, even if it redirects. If `false`, the redirected URL will be scanned instead. redirect_level: type: string default: same_domain enum: - none - check_accessibility - same_host - same_domain - allow_all writeOnly: true description: | Possible values: * `none` - the target is passed directly to the scanner * `check_accessibility` - the target is checked for accessibility and an error is thrown on any redirect * `same_host` - only redirects within the same host are allowed * `same_domain` - redirects to subdomains are allowed * `allow_all` - any redirects are allowed required: - tool_id discriminator: propertyName: tool_id mapping: '20': $ref: '#/components/schemas/SubdomainFinderStarter' '30': $ref: '#/components/schemas/WhoisLookupStarter' '70': $ref: '#/components/schemas/PortScannerStarter' '90': $ref: '#/components/schemas/UrlFuzzerStarter' '160': $ref: '#/components/schemas/VHostsFinderStarter' '170': $ref: '#/components/schemas/WebsiteScannerStarter' '240': $ref: '#/components/schemas/IcmpPingStarter' '260': $ref: '#/components/schemas/SharePointScannerStarter' '270': $ref: '#/components/schemas/WordpressScannerStarter' '280': $ref: '#/components/schemas/DrupalScannerStarter' '290': $ref: '#/components/schemas/JoomlaScannerStarter' '310': $ref: '#/components/schemas/WebsiteReconStarter' '350': $ref: '#/components/schemas/NetworkScannerStarter' '380': $ref: '#/components/schemas/SQLiExploiterStarter' '390': $ref: '#/components/schemas/DomainFinderStarter' '400': $ref: '#/components/schemas/PasswordAuditorStarter' '450': $ref: '#/components/schemas/SslScannerStarter' '490': $ref: '#/components/schemas/SniperStarter' '500': $ref: '#/components/schemas/WafDetectorStarter' '510': $ref: '#/components/schemas/APIScannerStarter' '520': $ref: '#/components/schemas/CloudScannerStarter' '530': $ref: '#/components/schemas/PeopleHunterStarter' '540': $ref: '#/components/schemas/KubernetesScannerStarter' SubdomainFinderStarter: allOf: - $ref: '#/components/schemas/Scan' - type: object title: Subdomain Finder properties: tool_params: $ref: '#/components/schemas/FindSubdomainsParams' writeOnly: true WhoisLookupStarter: allOf: - title: Whois Lookup - $ref: '#/components/schemas/BaseScannerStarter' PortScannerStarter: allOf: - $ref: '#/components/schemas/Scan' - type: object title: Port Scanner properties: tool_params: $ref: '#/components/schemas/PortScannerParams' writeOnly: true UrlFuzzerStarter: allOf: - $ref: '#/components/schemas/Scan' - type: object title: URL Fuzzer properties: tool_params: $ref: '#/components/schemas/UrlFuzzerParams' writeOnly: true VHostsFinderStarter: allOf: - $ref: '#/components/schemas/BaseScannerStarter' - title: Virtual Hosts Finder WebsiteScannerStarter: allOf: - $ref: '#/components/schemas/Scan' - type: object title: Website Scanner properties: tool_params: $ref: '#/components/schemas/WebsiteScannerParams' writeOnly: true authentication: $ref: '#/components/schemas/WebsiteScannerAuth' writeOnly: true default: null IcmpPingStarter: allOf: - title: ICMP Ping - $ref: '#/components/schemas/BaseScannerStarter' SharePointScannerStarter: allOf: - title: SharePoint Scanner - $ref: '#/components/schemas/BaseScannerStarter' WordpressScannerStarter: allOf: - $ref: '#/components/schemas/Scan' - type: object title: Wordpress Scanner properties: tool_params: $ref: '#/components/schemas/WordpressScannerParams' writeOnly: true DrupalScannerStarter: allOf: - title: Drupal Scanner - $ref: '#/components/schemas/BaseScannerStarter' JoomlaScannerStarter: allOf: - title: Joomla Scanner - $ref: '#/components/schemas/BaseScannerStarter' WebsiteReconStarter: allOf: - title: Website Recon - $ref: '#/components/schemas/BaseScannerStarter' NetworkScannerStarter: allOf: - $ref: '#/components/schemas/Scan' - type: object title: Network Scanner properties: tool_params: $ref: '#/components/schemas/NetworkScannerParams' writeOnly: true SQLiExploiterStarter: allOf: - $ref: '#/components/schemas/Scan' - type: object title: SQLi Exploiter properties: tool_params: $ref: '#/components/schemas/SQLiExploiterParams' writeOnly: true DomainFinderStarter: allOf: - $ref: '#/components/schemas/Scan' - type: object title: Domain Finder properties: tool_params: $ref: '#/components/schemas/FindDomainsParams' writeOnly: true PasswordAuditorStarter: allOf: - $ref: '#/components/schemas/Scan' - type: object title: Password Auditor properties: tool_params: $ref: '#/components/schemas/PasswordAuditorParams' writeOnly: true SslScannerStarter: allOf: - $ref: '#/components/schemas/Scan' - type: object title: SSL Scanner properties: tool_params: $ref: '#/components/schemas/SslTlsScanParams' writeOnly: true SniperStarter: allOf: - $ref: '#/components/schemas/Scan' - type: object title: Sniper properties: tool_params: $ref: '#/components/schemas/SniperParams' writeOnly: true WafDetectorStarter: allOf: - title: WAF Detector - $ref: '#/components/schemas/BaseScannerStarter' APIScannerStarter: allOf: - $ref: '#/components/schemas/Scan' - type: object title: API Scanner properties: tool_id: type: integer example: 510 target_name: type: string example: https://pentest-ground.com:9000 tool_params: $ref: '#/components/schemas/APIScannerParams' type: object properties: openapi_url: type: string example: https://pentest-ground.com:9000/openapi.yaml writeOnly: true authentication: type: object properties: type: type: string description: Authentication type to be used. enum: - headers headers: type: array items: type: string example: 'X-Auth-Token: b191106ea2a7cc74b713e467a4986599' description: | Array of authentication headers in the format "key: value". For example: - "X-Auth-Token: your-token" - "Authorization: Bearer your-bearer-token". CloudScannerStarter: allOf: - $ref: '#/components/schemas/Scan' - type: object title: Cloud Scanner properties: tool_params: $ref: '#/components/schemas/CloudScannerParams' writeOnly: true PeopleHunterStarter: allOf: - title: People Hunter - $ref: '#/components/schemas/BaseScannerStarter' KubernetesScannerStarter: allOf: - $ref: '#/components/schemas/Scan' - type: object title: KubernetesScanner properties: tool_params: $ref: '#/components/schemas/KubernetesScanParams' writeOnly: true ErrorResponse: type: object additionalProperties: false properties: status: type: integer example: 401 message: type: string example: No API key specified FindSubdomainsParams: type: object additionalProperties: false properties: scan_type: default: deep type: string enum: - light - deep - custom web_details: type: boolean default: true description: >- Extract web server information for web server subdomains. Enabling this results in a longer scan whois: type: boolean default: false description: Extract whois information for the subdomain unresolved_results: type: boolean default: false description: >- Unresolved subdomains found by the tool are kept in the result list, but without an IP address search_methods: type: object description: >- Methods to be used for discovery. All are used by default for a deep scan. For a custom scan, you need to specify at least one. properties: passive_detection: type: boolean default: true description: Search historical subdomains dns_records: type: boolean default: true description: Zone transfer dns_enumeration: type: object properties: enabled: type: boolean default: true wordlist_id: type: integer default: 1600 description: DNS bruteforcing using a wordlist ctr_search: type: boolean default: true description: Certificate Transparency Logs external_api_search: type: boolean default: true description: Subdomains from external APIs bing_search: type: boolean default: true description: Bing search google_search: type: boolean default: true description: Google search html_search: type: boolean default: true description: Subdomains extracted from HTML links and HTTP headers ssl_search: type: boolean default: true description: Extract from SSL certificates revdns_search: type: boolean default: true description: Reverse DNS on target IP ranges alteration_search: type: boolean default: true description: >- Generates permutations and alterations of the subdomain names found so far in the scan - disabling this option should speed up scans when there is a large number of subdomains, but might reduce the number of results cname_search: type: boolean default: true description: Extract from CNAMEs BaseScannerStarter: allOf: - $ref: '#/components/schemas/Scan' - type: object properties: tool_params: description: The tool has no custom parameters writeOnly: true type: object PortScannerParams: type: object additionalProperties: false properties: scan_type: default: deep type: string description: > Determines the Port Scanner scan type that will be used. `light` scans the top 1000 TCP ports, using the TCP SYN scanning technique. For UDP, it scans the top 100 ports. This scan type also performs service detection. `deep` scans the top 5000 TCP ports using the TCP SYN scanning technique or the top 1000 UDP ports if UDP protocol is set. Additionally, it performs service detection and operating system identification. `custom` allows you to enable/disable custom scanning options such as OS detection, service version, traceroute, scanning techinique and to select custom ports. enum: - light - deep - custom protocol: default: tcp type: string enum: - tcp - udp check_alive: type: boolean default: true os_detection: type: boolean default: false traceroute: type: boolean default: false scan_technique: type: string default: sS example: sS enum: - sS - sT - sA - sW - sM - sN - sF - sX - sY - sZ - sO service_detection: type: boolean default: true port_range: type: object properties: start_port: type: integer end_port: type: integer example: start_port: 0 end_port: 443 port_top: type: integer enum: - 10 - 100 - 1000 - 5000 port_list: type: array items: type: integer example: - 22 - 80 - 443 items: type: integer minimum: 1 maximum: 65535 UrlFuzzerParams: type: object additionalProperties: false properties: scan_type: default: deep type: string enum: - light - deep - custom request_options: type: object properties: method: type: string enum: - GET - POST default: GET description: The method used for making HTTP requests. post_data: type: string description: >- POST data to be sent with every request. Valid only if the POST method is selected. Can be used as the fuzzing location if it contains a FUZZ marker. example: username=admin&pass=FUZZ headers: type: array items: type: string description: >- Custom headers to be sent with every request. Cannot be used as the fuzzing location. If not set, at least a default User Agent will be set. example: - 'Cookie: PHPSESSID=298zf09h' - 'User-Agent: Mozilla/5.0' max_retries: type: integer minimum: 0 maximum: 10 default: 3 description: >- Maximum number of retries for an HTTP request in case of an error. retry_delay_factor: type: number format: float minimum: 0 maximum: 120 default: 1 description: >- The delay between retries increases exponentially. If the factor to multiply the delay is 1 (default), the first retry is sent immediately (after 0s), the second one after 1s, then 2s, 4s and so on. If the factor is 0.1, the sleeps between the retries are':' 0s, 0.1s, 0.2s, 0.4s and so on. force_retry_http_codes: type: string example: 429,500-505 description: >- By default, the retry policy is applied only on connection errors. With this option, you can enforce retrying on responses with these status codes. thread_count: type: integer minimum: 1 maximum: 10 default: 7 description: Number of parallel requests (threads) for the scan. requests_delay: type: number format: float minimum: 0 maximum: 3600 default: 0 description: >- The delay between two consecutive requests, in seconds. Requires `thread_count` to be set to 1. request_timeout: type: number format: float exclusiveMinimum: true minimum: 0 maximum: 43200 default: 4 description: Timeout for an HTTP request, in seconds. payload_options: type: object properties: type: type: string enum: - wordlist - sequence default: wordlist description: >- The type of the input wordlist. If `wordlist` is selected, the payloads that replace the 'FUZZ' marker will be taken from an input wordlist (custom or default). If `sequence` is selected, a sequence of numbers will be generated as input wordlist, with a given start, end and step. wordlist_id: type: integer default: 1104 description: >- The ID of the wordlist to be used for fuzzing. Can only be used with the `wordlist` payload type. Available wordlists IDs can be retrieved using the `/wordlists` endpoint. dynamic_wordlist: type: boolean default: true description: >- Extend the input wordlist with relevant words from the HTML page located at the input target URL. Can only be used with the `wordlist` payload type. sequence: type: object properties: from: type: integer default: 0 description: The number to start the sequence from. to: type: integer default: 100 description: The ending number of the sequence. step: type: integer default: 1 description: The step to increment the sequence by. Can not be 0. description: >- Describes the parameters of the sequence to be generated. Can only be used with the `sequence` payload type. extension_categories: type: array items: type: string enum: - no_ext - configs - sources - archives - databases - logs - backups - docs - web example: - no_ext - web description: > Append different extensions to every item in the input wordlist. You can specify an extension category and/or no extension. If no extension category or no custom extension is set, no extension will be used. The available categories and the corresponding extensions are: * no_ext; * configs: `.conf`, `.cfg`, `.txt`, `.xml`, `.json`, `.ini`; * sources: `.bat`, `.c`, `.java`, `.cpp`, `.cs`, `.h`; * archives: `.zip`, `.tar`, `.tar.gz`, `.tgz`, `.gz`, `.7z`, `.bzip`, `.rar`, `.jar`, `.apk`; * databases: `.sql`, `.mdb`, `.db`, `.nsf`, `.csv`, `.dbf`; * logs: `.log`, `.err`, `.journal`; * backups: `.old`, `.back`, `.bkp`, `.bak`, `.tmp`, `.test`, `.dev`, `.prod`; * docs: `.doc`, `.docx`, `.odt`, `.xls`, `.xlsx`, `.rtf`, `.pdf`, `.ppt`, `.pptx`; * web: `.asp`, `.aspx`, `.php`, `.jsp`, `.shtml`, `.htm`, `.html`, `.dll`, `.pl`, `.py`, `.cgi`, `.cfm`, `.sh`. custom_extensions: type: array items: type: string example: - .php.old - .jsp.bak - .swp description: >- Specify custom extensions to be appended to every item in the input wordlist, up to 10 per scan. max_recursion_depth: type: integer minimum: 0 maximum: 3 default: 0 description: >- If greater than 0, the fuzzing will be done recursively - for each found directory in the URL path, a new search with the initial wordlist will be started, up to the maximum depth specified. mutate: type: boolean default: true description: >- Apply various mutations to the identified files in order to find other resources (e.g. `config.php`, `config2.php`, `config_old.php`, `config-dev.php`). filter_results: type: object description: Options to filter the results. properties: type: type: string enum: - auto - manual default: auto description: >- If the response filter is `auto`, responses with the 404 status code are discarded and (only for the GET method) filtered using a soft-404 detection algorithm. If the response_filter is set to `manual`, results will be filtered according to the specified `match` and `ignore` conditions. match: $ref: '#/components/schemas/UrlFuzzerResponseFilter' ignore: $ref: '#/components/schemas/UrlFuzzerResponseFilter' WebsiteScannerParams: additionalProperties: false type: object properties: scan_type: default: deep type: string enum: - light - deep - custom attack_active: type: array items: type: string enum: - xss - sqli - lfi - oscmdi - ssrf - open_redirect - broken_authentication - php_code_injection - js_code_injection - ruby_code_injection - python_code_injection - perl_code_injection - log4j_rce - ssti - xxe - viewstate_rce - prototype_pollution - backup_files - request_url_override - http_request_smuggling - session_fixation - idor - jwt - response_header_injection description: >- When set, only the methods in the list will run. If not set or `null`, will run all methods. if the list will be empty `[]` no one of those methods will run attack_passive: type: array items: type: string enum: - security_headers - cookie_security - directory_listing - secure_communication - weak_password_submission - error_debug_messages - password_cleartext - cross_domain_source - mixed_content - sensitive_data - login_interfaces - file_upload - path_disclosure - sql_statement_in_request - password_in_response - session_token_in_url - api_endpoint description: >- When set, only the methods in the list will run. If not set or `null`, will run all methods. if the list will be empty `[]` no one of those methods will run discovery: type: array items: type: string enum: - fingerprint - software_vulnerabilities - check_robots - outdated_js - untrusted_certificates - client_access_policies - http_debug_methods - security_txt - cors_misconfiguration - resource_discovery - sensitive_files - admin_consoles - interesting_files - server_info_disc - server_software - misconfigurations - graphql_endpoint - fuzz_openapi_locations description: >- When set, only the methods in the list will run. If not set or `null`, will run all methods. if the list will be empty `[]` no one of those methods will run spider: type: object properties: approach: type: string default: auto enum: - auto - classic - spa depth: type: integer default: 10 max_time: type: integer default: 3600 description: A maximum value of time spent spidering in seconds. exclude_urls: type: array items: type: string example: - http://www.target.com/exclude_me - http://www.target.com/exclude_me_too description: >- Insert URLs to be excluded from the spidering process. This stops the scanner from processing endpoints and limits the scope, making it useful when certain areas do not require scanning for vulnerabilities. include_urls: type: array items: type: string example: - http://www.target.com/include_me - http://www.target.com/include_me_too description: >- Add line-separated URLs to be included in the spidering process. This allows the scanner to reach endpoints that are hard to find automatically or are not linked with other endpoints. subdomains_in_scope: type: array items: type: string example: - api - staging.dev.api description: >- Subdomains of the target to be scanned if requests to them are found during the spidering process. This allows the scanner to expand its scanning scope to specific subdomains of the target. If left empty, only the subdomain `api` will be considered in scope. For example, if `http://example.com` is the target, the subdomain `api.example.com` will be in scope. requests_per_second: type: integer default: 100 minimum: 1 maximum: 10000 description: >- A maximum value of requests per second. Speed may be lower than the maximum due to network latency, throtlling or load on the target server. WebsiteScannerAuth: type: object nullable: true description: >- Scan the target web application as an authenticated user or behind protected resources. If it is not set, the scan will be performed as an unauthenticated user. It is not allowed if `scan_type` is `light`. properties: type: type: string description: Authentication type to be used. enum: - login_form - cookies - headers discriminator: propertyName: type mapping: login_form: $ref: '#/components/schemas/WebsiteScannerLoginFormAuth' cookies: $ref: '#/components/schemas/WebsiteScannerCookiesAuth' headers: $ref: '#/components/schemas/WebsiteScannerHeadersAuth' WordpressScannerParams: additionalProperties: false type: object properties: scan_type: default: custom type: string enum: - light - deep - custom detection_mode: default: aggressive type: string enum: - passive - aggressive enumerate: type: array nullable: true items: type: string enum: - users - vulnerable_themes - vulnerable_plugins - config_backups - database_exports - timthumbs description: >- When set, only the methods in the list will run. If not set or `null`, will run all methods NetworkScannerParams: type: object additionalProperties: false properties: preset: default: deep type: string description: > Determines the Network Scanner scan type that will be used. `light` uses the `version_based` scanning engine on top 100 ports. `deep` uses the `version_based`, `sniper` and `nuclei` scanning engines on top 5000 ports (TCP) or top 1000 ports (UDP). `custom` allows you to use custom configurations of scanning engines and ports. enum: - light - deep - custom scanning_engines: type: array description: >- Scanning engines that will be loaded for a scan. Can be set only if `custom` preset was selected. It must contain at least one engine. example: - version_based - sniper - nuclei - openvas items: type: string enum: - version_based - sniper - nuclei - openvas engines_options: type: object properties: requests_per_second: type: integer default: 50 description: >- Specify a maximum number of requests per second between 1 and 1000. It is only valid with the `deep` preset or with the `custom` preset if `nuclei` and/or `openvas` are included in `scanning_engines`. cves_to_scan: type: array default: [] maxItems: 500 description: >- Specify particular CVEs for scanning. Can be set only if `custom` preset was selected. Limited to 500 CVEs, and mutually exclusive with `scan_cisa_kev_only`. example: - CVE-2024-23108 - CVE-2024-27198 items: type: string scan_cisa_kev_only: type: boolean default: false description: >- Scan only the CVEs present in the CISA KEV catalog that are detectable by the selected engines. Can be set only if `custom` preset was selected, and is mutually exclusive with `cves_to_scan`. check_alive: type: boolean default: true protocol_type: default: tcp type: string enum: - tcp - udp port_range: type: object properties: start_port: type: integer end_port: type: integer example: start_port: 0 end_port: 443 port_top: type: string enum: - OpenVAS default - '10' - '100' - '1000' - '5000' port_list: type: array items: type: integer example: - 22 - 80 - 443 items: type: integer minimum: 1 maximum: 65535 SQLiExploiterParams: type: object additionalProperties: false properties: method: type: string enum: - GET - POST default: GET description: The method used for making HTTP requests. post_data: type: string description: >- POST data to be sent with every request. Only allowed when the request method is `POST` example: username=admin&pass=FUZZ enumeration: type: array default: - extract_user - extract_db - extract_host - extract_banner - extract_users - extract_passwords - extract_tables - extract_databases items: type: string enum: - extract_user - extract_db - extract_host - extract_banner - extract_users - extract_passwords - extract_tables - extract_databases description: >- Choose which data you would like to extract from the database. If the list is not set, all data will be extracted. light_crawling: type: boolean default: false description: >- Crawl the website up to second-level links and try to discover SQLi vulnerabilities automatically. advanced: type: object properties: cookie_header: type: string example: PHPSESSID=a8fh54s; HttpOnly; test_parameters: type: array items: type: string description: >- A list of parameters to be tested. If not set, SQLMap will try to determine the available parameters by itself. example: - id - pass database_type: type: string enum: - MySQL - Oracle - PostgreSQL - Microsoft SQL Server - Microsoft Access - IBM DB2 - SQLite - Firebird - Sybase - SAP MaxDB - HSQLDB - Informix description: >- Force SQLMap to only test payloads for this specific database. If none is specified, the tool will detect the database type by itself. tamper: type: string enum: - between - charencode - equaltolike - space2comment - base64_encode description: Use the specified script to tamper (modify) payloads. payload: type: object properties: prefix: type: string description: String to prepend to each payload suffix: type: string description: String to append to each payload detection: type: object properties: level: type: integer default: 1 enum: - 1 - 2 - 3 - 4 - 5 description: >- The diversity of the tests performed. By default, SQLMap will test all GET and POST parameters specified / found. However, you can add additional entry points using the level option. For example, Level 2 adds HTTP Cookie testing, while Level 3 adds User Agent / Referer testing. The higher the level, the longer the scan takes. risk: type: integer default: 1 enum: - 1 - 2 - 3 description: >- How aggressive the tests should be. If you choose a higher risk, SQLMap will include more resource-intensive tests, which might make the database temporarily inaccessible to legitimate users (for the duration of the test). For example, Risk 2 will run heavy time-based SQL Injection queries alongside the default Risk 1 payloads. Also, the higher the risk, the longer the scan takes. http_code: type: integer description: HTTP code to match when a query is evaluated to True techniques: type: array default: - bool_blind - error_based - union_query - stacked_queries - time_blind - query_inline items: type: string enum: - bool_blind - error_based - union_query - stacked_queries - time_blind - query_inline description: >- Choose which type of SQLi techniques to use. Default: all (BEUSTQ). delay: type: integer default: 0 minimum: 0 maximum: 600 description: Time delay (in seconds) between two consecutive HTTP attempts test_web_forms: type: boolean default: false description: >- By default, SQLi Exploiter injects the payloads in URL Parameters, POST Data and HTTP Headers. Enabling this option restricts testing to web forms only. FindDomainsParams: type: object properties: scan_type: default: deep type: string enum: - light - deep - custom ssl_search: type: boolean default: true builtwith: type: boolean default: false reverse_whois: type: boolean default: false minimum_weight: type: integer default: 30 PasswordAuditorParams: additionalProperties: false type: object properties: attack_type: default: dictionary type: string enum: - dictionary - password_spray custom_port_list: type: array description: List of custom ports. `port_type` must be set to `custom`. items: type: integer example: - 22 - 80 - 443 items: type: integer minimum: 1 maximum: 65535 port_type: type: string default: top_ports enum: - top_ports - custom - from_url description: >- Ports to be scanned. By default, the top 100 common ports will be scanned. If set to `custom`, the `custom_port_list` parameter is required. If set to `from_url`, the given target must be an URL. services: type: array items: type: string enum: - amqp - docker - ftp - http - mqtt - mssql - mysql - postgresql - rdp - redis - smb - ssh - stomp - telnet - winrm - vnc description: >- When set, only the methods in the list will run. If not set or `null`, the default methods will be used. usernames_wordlist_id: type: integer description: >- The available wordlists can be retrieved using the `/wordlists` endpoint. If not set, the default worldist will be used. passwords_wordlist_id: type: integer description: >- The available wordlists can be retrieved using the `/wordlists` endpoint. If not set, the default worldist will be used. attempt_delay: type: integer default: 0 minimum: 0 maximum: 600 description: >- Time delay (in seconds) between two consecutive authentication attempts. lockout_period: type: integer default: 5 minimum: 1 maximum: 720 description: >- Minutes to wait before the next attempt. Available only for `password_spray` attack_type. attempts_per_period: type: integer default: 2 minimum: 1 maximum: 50000 description: >- Number of attempts before waiting `lockout_period`. Available only for `password_spray` attack_type. check_default_credentials: type: boolean default: true SslTlsScanParams: additionalProperties: false type: object properties: preset: default: deep type: string description: > Scanning presets that define the complexity of a scan. Light scans only on port 443. Deep scans on top 1000 most common ports. Custom allows engine selection and personalized port selection. enum: - light - deep - custom scanning_engines: default: - certificate - vulnerability type: array description: >- Scanning engines that will be loaded for a scan. Can be set only if `custom` preset was selected. It must contain at least one engine. example: - certificate - vulnerability items: type: string enum: - certificate - vulnerability port_range: type: object description: >- Input type for port scanning. Port ranges are user provided port intervals that are passed to the port discovery engine. Only one port input type is allowed. properties: start_port: type: integer end_port: type: integer example: start_port: 1 end_port: 443 port_top: type: string description: >- Input type for port scanning. Port tops are predefined port lists containing various commonly used port numbers that are passed to the port discovery engine. Only one port input type is allowed. enum: - '10' - '100' - '1000' - '5000' - all port_list: type: array description: >- Input type for port scanning. Port lists are user provided port lists that are passed to the port discovery engine. Only one port input type is allowed. items: type: integer example: - 22 - 80 - 443 items: type: integer minimum: 1 maximum: 65535 SniperParams: type: object additionalProperties: false properties: port_range: type: object properties: start_port: type: integer end_port: type: integer example: start_port: 0 end_port: 443 port_top: type: string enum: - '100' - '1000' - '5000' - all port_list: type: array items: type: integer example: - 22 - 80 - 443 items: type: integer minimum: 1 maximum: 65535 check_alive: type: boolean default: true safe_exploits_only: type: boolean default: true extractors: type: array items: type: string enum: - basic_system_information - local_users - processes - screenshot - filesystem - network_data - interesting_files - secrets description: |- Extractors to use. If not set, the defaults will be used: basic_system_information, interesting_files, secrets. If it is an empty list, no extractor will be used auth: $ref: '#/components/schemas/SniperAuth' cves_to_scan: type: array description: Specify particular CVEs for scanning. example: - CVE-2024-23108 - CVE-2024-27198 items: type: string APIScannerParams: additionalProperties: false type: object description: >- One of `openapi_url`, `openapi_file`, `postman_url`, `postman_file` can be set or none. properties: scan_type: default: deep type: string enum: - light - deep - custom api_type: default: auto type: string description: Type of API to scan. Auto option fingerprints both types of APIs. enum: - auto - rest - graphql openapi_url: type: string format: uri description: URL to the OpenAPI specification file. postman_url: type: string format: uri description: URL to the Postman collection file. openapi_file: type: string description: Base64-encoded OpenAPI specification file. postman_file: type: string description: Base64-encoded Postman collection file. CloudScannerParams: additionalProperties: false type: object properties: detect_cloud_provider: default: true type: boolean description: Enables a test for detecting the cloud provider of the target. detect_cloud_vulnerabilities: default: true type: boolean description: >- Enables a test for cloud vulnerabilities and misconfigurations on the target, based on the detected cloud provider. If detect_cloud_provider is set to False, security tests for all currently integrated cloud providers will be performed. Setting detect_cloud_provider to False can be useful if you believe the tool is not properly detecting your target"s cloud provider. KubernetesScanParams: additionalProperties: false type: object properties: preset: default: deep type: string description: > Scanning presets that define the complexity of a scan. Light mode scans on top 10 most common ports and use only passive detections. Deep mode scans on top 100 most common port, use active and passive detections and authentication can be enabled. Custom allows active detection selection, personalized port selection and authentication configuration. enum: - light - deep - custom active_modules: type: boolean default: true check_alive: type: boolean default: true port_range: type: object description: >- Input type for port scanning. Port ranges are user provided port intervals that are passed to the port discovery engine. Only one port input type is allowed. properties: start_port: type: integer end_port: type: integer example: start_port: 1 end_port: 443 port_top: type: string description: >- Input type for port scanning. Port tops are predefined port lists containing various commonly used port numbers that are passed to the port discovery engine. Only one port input type is allowed. enum: - '10' - '100' - '1000' - '5000' - all port_list: type: array description: >- Input type for port scanning. Port lists are user provided port lists that are passed to the port discovery engine. Only one port input type is allowed. items: type: integer example: - 22 - 80 - 443 items: type: integer minimum: 1 maximum: 65535 auth: $ref: '#/components/schemas/KubernetesScannerAuth' UrlFuzzerResponseFilter: type: object properties: http_codes: type: string example: 200-205,301 description: Match the responses with these HTTP codes. response_size: type: object properties: operator: type: string enum: - '=' - < - '>' - <= - '>=' limit: type: number format: float minimum: 0 maximum: 10240 description: >- Match the responses with the size respecting this condition. The limit is expressed in KB. content: type: string example: error description: String to match in the response text. WebsiteScannerLoginFormAuth: allOf: - $ref: '#/components/schemas/WebsiteScannerAuth' - type: object properties: params: type: object properties: login_page_url: example: http://www.example.com type: string description: URL of the login page. username: example: admin type: string description: Username to be used for authentication. password: example: pass type: string description: Password to be used for authentication. WebsiteScannerCookiesAuth: allOf: - $ref: '#/components/schemas/WebsiteScannerAuth' - type: object properties: params: type: object properties: cookie_header: example: PHPSESSID=8jhs0rmecss6r2bvx2fcqa3hz1; token=J51Kti3 type: string description: Cookies to be used for authentication. WebsiteScannerHeadersAuth: allOf: - $ref: '#/components/schemas/WebsiteScannerAuth' - type: object properties: params: type: object properties: headers: example: - 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJrZXkiOiJ2YWwifQo=' - 'Cookie: PHPSESSID=8jhs0rmecss6r2bvx2fcqa3hz1' type: array items: type: string description: Headers to be used for authentication. SniperAuth: type: object required: - protocol - port - params properties: protocol: type: string enum: - ssh - smb - winrm - mysql port: type: integer minimum: 1 maximum: 65535 description: >- The port to use authentication on. This overrides other port selections. params: type: object required: - username properties: username: type: string password: type: string discriminator: propertyName: protocol mapping: ssh: $ref: '#/components/schemas/SniperSshAuth' winrm: $ref: '#/components/schemas/SniperWinrmAuth' smb: $ref: '#/components/schemas/SniperSmbAuth' mysql: $ref: '#/components/schemas/SniperMysqlAuth' KubernetesScannerAuth: type: object required: - service_token properties: service_token: type: string description: Service token to be used for authentication. SniperSshAuth: allOf: - $ref: '#/components/schemas/SniperAuth' - type: object properties: params: type: object properties: private_key: type: string SniperWinrmAuth: allOf: - $ref: '#/components/schemas/SniperAuth' - type: object properties: params: type: object required: - password - type properties: winrm_auth_type: type: string enum: - ntlm - basic SniperSmbAuth: allOf: - $ref: '#/components/schemas/SniperAuth' - type: object properties: params: type: object required: - password properties: domain: type: string nullable: true description: If not specified, local authentication will be used SniperMysqlAuth: allOf: - $ref: '#/components/schemas/SniperAuth' - type: object properties: params: type: object required: - password - database properties: database: type: string responses: UnauthorizedError: description: API key is missing or invalid content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ForbiddenError: description: You can"t perform this action. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ObjectNotFoundError: description: The object with the given ID was not found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' TooManyRequestsError: description: Too many requests made in a short period of time content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: bearerAuth: type: http scheme: bearer description: >- Use the "API key" from the [profile page](https://app.pentest-tools.com/account/api) as the token ````