DOCSEARCHbyAlgolia
Submit Docs

ZeroThreat Documentation

website·Indexed 35 days ago

https://help.zerothreat.ai/docs

Documentation for ZeroThreat, featuring guides on on-premises installation, configuration, and license management. Includes instructions for managing targets, scans, and organizations, as well as integrations with CI/CD tools like Azure Pipelines and CircleCI, and issue trackers such as Jira, GitHub Issues, GitLab Issues, and Trello.

Tokens
38.8K
Snippets
41
Records
285
Agent score
51%

What's inside ZeroThreat

  1. Overview of ZeroThreat On-Prem Configuration

    ZeroThreat On-Prem configuration settings are managed at the organization level and are typically handled by security engineers, platform teams, or administrators. These settings are required to enable AI-driven features, configure mail servers for system notifications, and set up automated pentesting and mail server testing within the environment.

  2. Overview of ZeroThreat On-Prem Scanning

    ZeroThreat On-Prem allows security scans to be run entirely within a local infrastructure, eliminating the need to route scan traffic through the cloud. This enables the assessment of applications and APIs that are not publicly accessible, making it ideal for organizations behind firewalls, private networks, or those with strict regulatory and compliance constraints regarding data movement.

    Key use cases include:

    • Scanning internal or private applications.
    • Scanning environments with restricted outbound internet access.
    • Meeting strict compliance or data residency requirements.

    ZeroThreat On-Prem is supported on Windows, Linux, and macOS.

  3. Overview of ZeroThreat DAST capabilities

    ZeroThreat is an AI-driven Dynamic Application Security Testing (DAST) platform designed for fast, zero-configuration security scanning of web applications and APIs. It focuses on reducing manual penetration testing efforts through high-precision reporting and an intelligent crawler capable of discovering vulnerabilities beyond the OWASP Top 10, including those behind authentication. Key capabilities include:

    • Web App Security Testing: Detection, triage, and remediation of vulnerabilities to meet regulatory standards such as HIPAA, PCI DSS, ISO27001, and GDPR.
    • Secret Scanning: Identification of exposed sensitive information including API keys, passwords, PII, and access tokens under the Information Exposure category.

  4. Overview of Gen AI capabilities in ZeroThreat On-Prem

    ZeroThreat utilizes AI-driven capabilities across the platform to provide executive summaries for scan results, remediation guidance, fix recommendations, and vulnerability explanations. In On-Prem deployments, users must connect their own AI providers to ensure alignment with internal security policies, compliance, and data handling requirements.

  5. Overview of ZeroThreat Notification Integrations

    ZeroThreat provides notification integrations that send real-time scan alerts directly to communication tools. These alerts notify teams when a scan starts or completes, allowing for high visibility of scan activity across environments and faster response to discovered vulnerabilities without requiring constant dashboard monitoring.

  6. Overview of Playwright Specs integration in ZeroThreat

    ZeroThreat supports Playwright Specs integration to execute real business workflows (e.g., multi-step checkouts, HR onboarding, approval chains) during security scans. This provides deeper coverage for conditionally accessible features and complex user flows that automated crawling cannot reliably reach. Supported project languages include TypeScript, JavaScript, and Python.

  7. Overview of Custom Attack Templates in ZeroThreat

    Attack Templates allow users to extend ZeroThreat's default scanning coverage by importing custom security checks. These templates are configured at the organization level and can be reused across various targets and scans via Scan Profiles. ZeroThreat supports templates written in Nuclei syntax or Burp BCheck syntax.

    Feature Availability: Custom Attack Templates are available only in the following plans:

    • Professional Cloud
    • Enterprise Cloud
    • Enterprise Pay-Per-Scan
    • Enterprise On-Prem

  8. Integrate ZeroThreat On-Prem with external issue trackers

    ZeroThreat On-Prem allows security teams to convert validated scan findings into actionable tasks within project management systems while keeping scanning operations inside their own network environment. This integration ensures that vulnerabilities are tracked and prioritized through structured engineering processes. Each created issue includes severity levels, technical evidence, request/response data, and recommended remediation steps. Unlike the Cloud version, the On-Prem version connects to these systems using secure tokens from within the organization's own infrastructure.

    Supported platforms include:

    • Jira
    • GitHub Issues
    • Azure Boards
    • GitLab Issues
    • Trello

  9. Discover and analyze APIs using ZeroThreat API Discovery from Code

    ZeroThreat uses a dynamic, runtime approach to identify and analyze all exposed API endpoints within a web application. Unlike static analysis (SAST) or schema parsing, it discovers APIs by simulating real user behavior—such as navigating routes, clicking buttons, and submitting forms—during a scan. This method is particularly effective for single-page applications (SPAs) and dynamic interfaces where routes are rendered at runtime.

    Key capabilities include:

    • No Code Access: Does not require source code or repository access.
    • Real User Simulation: Discovers endpoints based on actual usage paths to reduce false positives.
    • Full Coverage: Captures client-server communication, including HTTP methods, parameter structures, request bodies, and responses.
    • DAST Integration: Discovered endpoints are automatically used by the DAST engine to test for API-specific vulnerabilities.

  11. Understand ZeroThreat Targets and Scope

    A target is the URL of a web application or website to be scanned (e.g., https://app.example.com). By default, ZeroThreat includes all URLs within the same domain in the scan and excludes different domains. To include external resources like third-party APIs or payment gateways (e.g., payments.thirdparty.com), you must explicitly add them to the 'Allowed Hosts' section in the Target Configuration.

  12. Analyze SSL Certificate security and configuration

    The SSL Certificate section of the scan report provides a detailed analysis of a website's SSL/TLS configuration to identify security weaknesses and compliance violations. It is divided into four key areas:

    1. Certificate Overview: Provides basic metadata including the Issuer, Expiration Date, Server IP Address, OCSP (Online Certificate Status Protocol) response, and the supported TLS/SSL protocols.
    2. Certificate Score: A security score based on industry best practices. It evaluates encryption algorithm strength, implementation of secure protocols (TLS 1.2/1.3), and the presence of weak ciphers or outdated hashing algorithms.
    3. Certificate Vulnerability Scan: Checks for specific high-profile SSL/TLS vulnerabilities, including:
      • Heartbleed: Memory leak vulnerability.
      • BREACH: HTTP compression exploit.
      • ROBOT: RSA-encrypted communication decryption.
      • POODLE: SSL 3.0 padding oracle attack.
      • Other: Weak Diffie-Hellman key exchange and BEAST attacks.
    4. Compliance Requirements: Highlights misconfigurations that may violate security frameworks such as PCI DSS (payment data), HIPAA (healthcare information), and NIST Guidelines.