Next-Generation Security for Single Page Applications (SPAs)
Headless browser capabilities detect vulnerabilities in modern client-side scripting and complex web applications
The automated web crawler found the majority of the screens we would expect, and being able to add scripts that the crawler would follow allowed us to increase the rate of coverage even more, even through very complex forms and user journeys.”
The biggest brands trust AppCheck
Headless Brower that understands the task at hand
Event based crawler, understands event handlers on a page and builds an event graph to understand and navigate modern applications.
Using real browsers and not virtual DOM models allows a full range of communication with modern applications, such as websockets and web assembly.
Create scripted workflows to cover areas of an application that might be hard to reach, such as multi step forms or complex interactions that other scanners simply cannot reach.
Framework Agnostic
By applying first principles to our crawling technology we are not dependant on any given framework, it doesn’t matter if you use angular, vue.js or react.
Two crawlers in one, while the browser crawler is interacting with the front end of the application, API seeding can be used in conjunction to fully capture all the back end interactions giving you complete coverage.
Scripted authentication, if a user can authenticate with your application we can, even if you have to go out to a 3rd party to authenticate or require a ToTP pin like google authenticate.
The power of DAST
Coverage of not only known vulnerabilities in your chosen frameworks but also unknown vulnerabilities in your code from real payload based assessments.
Identification of authorisation flaws and permissions flaws such as IDOR.
Supports modern application multi domain scanning, covering both your backend API and frontend SPA in the same scan.
Frequently asked questions
AppCheck’s SPA scanning uses a headless browser to natively execute and intercept client-side interactions. This approach allows our scanner to interact with complex elements and JavaScript-driven features in SPAs. With the use of event-based crawling, AppCheck’s scanner dynamically maps out navigation paths and actions on a page, ensuring broad and deep coverage of the application’s attack surface, even within complex forms and user journeys.
Yes, AppCheck provides comprehensive scanning capabilities for APIs, web applications, and infrastructure, allowing you to identify vulnerabilities across your entire digital environment.
Yes, AppCheck’s SPA scanner is framework-agnostic, meaning it isn’t dependent on any particular JavaScript framework. Our tool uses a first-principles approach to crawling technology, allowing it to handle applications built with various frameworks, including Angular, Vue.js, and React. This flexibility ensures comprehensive security coverage regardless of the technology stack used.
AppCheck supports scripted authentication, meaning it can navigate even complex login processes, including multi-step or third-party authentication flows. Our scanner can also handle advanced authentication types, such as ToTP pins (like Google Authenticator) and other challenging authentication processes, allowing it to access secured sections of your application reliably.
How does Single Page Application Vulnerability Scanning work?
AppCheck implements a proprietary scan engine specifically dedicated to SPA scanning. Developed in-house, the scan engine uses a headless browser to natively execute and intercept all client-side scripting interactions and API responses, enabling it to contextually navigate and scan even the most complex Single Page Applications.
When driving the application through a browser, the scanner applies various crawling styles suitable for modern applications: for example it may use heuristics to identify the key menu navigation components of a given web application, which allows it to focus on broad navigation; or it may focus attention on form-based user input to perform page-local navigation; or it may employ more basic techniques more akin to traditional link scraping (though instead through the browser) to ensure good coverage of an application’s attack surface. Constant improvement to our crawling technology is a key focus of research at AppCheck, as we push the effectiveness of automated scanning to the limits.
Plus all the benefits you'd expect from a leading Web Application Scanner:
-
Discover zero days, plus 100,000+ known security flaws (CVEs), plus full OWASP vulnerability coverage including injection, XSS, RCE and more
-
Conduct checks throughout the application life cycle, from development to production
-
Flex key user journeys and complete multi-stage authentication via a scriptable browser interface
-
Compatible with Jira and TeamCity, as well as other development tools
Put us to the test.
Try AppCheck for free
Contact us or call us 0113 887 8380
