technology software

English

gdpr_consent

consent

euconsent

cookieconsent_status

The domain 'detectify.com' uses the commercial generic top-level domain (.com) and has no subdomain. Count 9 characters in 'detectify' holding three vowels versus six consonants. Word splitting yields 3 words: detect, if, y. Median word length is 2 characters. No strong language cues emerged from the frequency lists.

html/ca/43/ca43df2c-db52-4ec5-931f-7a74bd1b001e_fallback.html.gz

Application security testing reimagined | Detectify

html/ca/43/ca43df2c-db52-4ec5-931f-7a74bd1b001e.html.gz

appId=cid-v1:89f47f4b-bed0-4db8-956b-d6e6dfac3fef

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes

Blank

cc045680a9899560e7f400f1fbea755642bd8e12770f669d6f038c0478b3deeb

d3c9fb587790ac9d0ca21b24ff677029a087a2070ece5f4e45609f6bb34ec194

d7ba610864f55019010a006c2d14b01be139ce51d372894e7b992d5e7e9eaa62

5b32d0f4cc86264573bd1263fd515e9cb52208929bd5e2854503ed067f8b8a0c

ca068de4db3990c449a3231171dbe0c560dbec2ba7135e0d734335fed3bc63dc

c94edc47728a8eaad932438a7b1facdb35f42a919fac1f7e36cd4475a3fedac5

0593b40d8e8c3b3a3508ac2b921987895e5d29af43e7b6e2e809c7a9a978aed7

849016804f7037c5a5a1e9ffe25cb9f968b54a6158c2262fc18508b9e2e39c4e

d317d64de40bb2f9aae8a8697c96f6df026ff8ef6a7cee59724b33939962e57f

30201d492fc07db75b18137fd2d00c700308c288dd2013d5e95d0b0b7f795a6e

fc8c3af242fa9f54ce6aefc09f37f78a6bdf7c416009086b6af3fe2d75f8f2bb

425ff30b4817a9f1c6c5f6c995bdbb2500ebadf3acac68fd7404dc944fc4f20d

e1f657c3790812fefe14dca0f4d68405f8c805487a1414e6ef8f8dbeee3f0c3f

fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

37c9a016f7344e09dd5938d201c106de064a49830be2c4856d51be3e4b1336fc

9cb55eb0961c35558469eb4aff6ab3453a156732ac80dc40c9b0f85caee2b021

7afd745573d8cb35926d5a50511e34759cd3b2bc5f4fde24abb7f694478e0798

viewport

https://detectify.com/site/themes/detectify/img/ogimage.png

Discover, classify, and scan all assets across your attack surface with DAST methods. Secure your domains, apps, and APIs. Go hack yourself!

description

twitter:card

twitter:site

twitter:title

twitter:description

msapplication-TileColor

theme-color

6e5af81e9b9ad8b8b3f862910caa55a97133a1348e0b9198f880b0959200ddea

ahrefs-site-verification

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

1API GmbH

DETECTIFY.COM

https://embed-ssl.wistia.com/deliveries/e7711feff628c100da3e7bb206becb1af49e7208.m3u8

Getting Started

Surface Monitoring

Asset Classification

Scan Recommendations

Our Approach to Assessment

Enforcing Security Policies

Application Scanning

Managing Vulnerabilities

Integrations

Zack 5min demo 4k

Hi. And welcome to Detectify. My name is Zach, senior customer success engineer. And today, I'd like to take a few minutes to talk about the common challenges facing security teams, our solutions to these challenges, and how we approach them practically.

As the attack surface changes day to day, week to week, month to month, it is very important to stay updated on which assets are exposed and interactable.

These changes can often introduce some degree of uncertainty which assets are the most important.

Our data actually shows that up to nine out of ten of the most critical web applications are not scanned at all.

We also know that modern threat actors are not just focused on CVEs. Misconfigurations and exposed API keys for example, are also exploited and frequently lead to compromise.

Now, at Detectify our aim is to perform dynamic vulnerability assessment of every exposed asset while also providing complete coverage and actionable results.

So where do we get started? The easiest way to get started is to add a DNS connector.

What a DNS connector will allow us to do is to integrate directly with your DNS provider. For example, Google Cloud, AWS, or Azure.

When adding a connector, we will then synchronize with your DNS provider three times a day every eight hours to automatically import all of the known records that are hosted in that provider. What this essentially allows us to do is know about anything that you know about.

Now, whether you choose to use a connector or not, we also supplement this with automatic asset discovery. So, in cases where you might have DNS records hosted with a different provider that have not been migrated, or simply an asset that isn't being hosted in one of these common DNS providers, we can then add an asset directly on the surface monitoring page and automatically perform asset discovery. What this allows us to do is enumerate all of the subdomains that are publicly exposed right

here. Now, with surface monitoring the next thing that we want to do is of course enable monitoring.

And, enabling monitoring can be done with just a couple of clicks. First, we find the asset that we're interested in covering and then click enable monitoring. When I click this button it opens up a new window and it will show me some settings as they relate to asset discovery or vulnerability assessment. Now, for best performance I recommend leaving these at their defaults, But, when you click enable surface monitoring for a second time that then enables surface monitoring on the root asset, but also all of the subdomains below it.

So, what that means is that for all six hundred and fifty six subdomains that we see for this first asset right here because surface monitoring has been enabled we are now covering the root asset and all six hundred and fifty six of its subdomains. This enables us to get immediate broad coverage of the entire domain and anything attached to it.

Now, once surface monitoring has been enabled and has been allowed to run for a small amount of time the next thing we'll start to do is perform automatic classification of assets. This can be found under the classification page. And with asset classification, this allows us to automatically categorize your web assets by analyzing response attributes. This could include content type, content length, HTTP response, among others.

And certain categories such as rich web apps or even basic web apps can be used to then determine where even deeper scanning should take place.

Now, depending on the number of assets you have, if you have quite a few different applications that appear here, you may just want to know which assets are best targeted with application scan. And, in that case, the application scanning page will show you directly scan recommendations. At the top here, we can see a selection of assets that we recommend for deeper scanning with application scan powered by that classifications page.

Now, whether you're using surface monitoring on its own or in combination with application scan, all assessment of your assets is going to be performed with payload based tests. These are built in house by our security research team, our crowdsource network of ethical hackers, and all backed up by our AI researcher, Alfred.

In practice, this enables us to go very broad with coverage with surface monitoring. But surface monitoring does not just perform vulnerability assessment. It also allows us to collect a broad array of discovery data, all visible under domains or the associated pages below it. For example, DNS records, IP addresses, ports, and technologies.

Depending on the information that you see here, depending on what you find interesting, This enables us to create custom policies based on some of our filter suggestions, for example, such as unencrypted web servers or risky ports, and allows you to create a custom policy for notifications for things that are perhaps outside of the scope of your security posture, but does not have an associated CVE or is not on its own a vulnerability such as port twenty two being exposed to the Internet. Custom policies can be created from the domains page and then viewed on the policies page itself and we can track breaches over time where breaches any instance of an asset matching that policy that we've created.

When we go into application scan, this then allows us to, again, cover individual applications more in-depth. Where surface monitoring allows us to cover a root domain and all of the subdomains at a very broad level with dynamic coverage, application scan is best targeted at those highly critical web applications. This allows us to make sure that we're covering that gap of those nine out of ten applications that are very frequently missed for vulnerability assessment.

Application scan allows us to crawl, fuzz, and scan in-depth your custom built applications for vulnerabilities.

Not just for CVEs, not just for the OASP top ten, but beyond that as well. Again, this is where we'd start to look at things like SQL injections, but also again exposed API keys for example.

Now, surface monitoring

is doing some of this as well, but whether you're using one, the other, or both, all of the vulnerabilities that we that we populate with Detectify will be visible on the vulnerabilities page itself. This is a real time feed that is kept up to date by both engines and allows us to see any vulnerability that we have reported over time.

For example, we have some AdMiner exposures, we have node exporter exposures, we have some CVEs, some other exposures, a lot of these are coming from surface monitoring in this case, others are coming from application scan.

If I were to open any one of these for example this AdMiner exposure, what all of our vulnerabilities have in common is their formatting.

In essence, what we want to show you is as much information as you need to replicate the the test itself and verify whether or not this vulnerability truly exists. Now, in this case, we'll show you where it was found, a command line that you can run when necessary or possible, severity, status, a brief description of the risk as we continue down the page, but then as we scroll further down this is where a lot of the really interesting data starts to come. We can show you the request and response headers and any additional details that you might need to indicate why we believe this vulnerability truly exists. And this is all based on again the payload based tests that we're sending not based on just the fingerprints of technologies that we find for example.

When we start to collect vulnerabilities or discover additional assets, we can then also notify you via our integrations.

Now,

our integrations are very powerful and allow us to integrate with almost any third party system that you can think of. Whether this is something that we have at a pre existing template for such as over email, or Jira or PagerDuty or Slack, Teams, etcetera, or a custom built integration using something like just an HTTP API. What this allows us to do is automatically notify you of any vulnerability or update within Detectify without requiring you to constantly be checking the UI five, ten, fifteen times a day.

Now, by leveraging, leveraging, excuse me, all of these features from asset discovery and classification to surface monitoring and in-depth vulnerability assessment, you can significantly uplift your security posture. And we'd love to help you do this with your own Detectify environment. So if you go to detectify dot com now, you can book a demo directly with a member of our team or start a free trial to explore on your own. Again, welcome to Detectify. Thank you very much for your time, and I hope you have a wonderful day.


    // 1. Initialize the dataLayer (only needs to be done once)
    window.dataLayer = window.dataLayer || [];

    // 2. Define the gtag function helper
    function gtag() {
        dataLayer.push(arguments);
    }

    // 3. Set the default Google Consent Mode status
    //    This MUST be done *before* any Google tags load or data is pushed
    gtag("consent", "default", {
        ad_personalization: "denied",
        ad_storage: "denied",
        ad_user_data: "denied",
        analytics_storage: "denied",
        functionality_storage: "denied",
        personalization_storage: "denied",
        security_storage: "granted",
        wait_for_update: 500,
    });

    // 4. Set other Google Tag configurations
    gtag("set", "ads_data_redaction", true);
    gtag("set", "url_passthrough", false);

    // 5. Push page-specific data to the dataLayer
    window.dataLayer.push({
        'site.websiteId': 'en',
        'site.websiteName': 'public',
        'site.environment': (document.location.hostname == 'detectify.com' ? 'production' : 'staging'),
        'site.version': '1.16.0',
        'user.isinternal': 'false',
        'page.path': document.location.pathname,
        'page.title': document.title,
        'page.hostname': document.location.hostname,
        'page.location': document.location.href
    });



(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
'https://analytics.detectify.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer','GTM-TWT88B');



piAId = '652623';
piCId = '9201';
piHostname = 'go.detectify.com';

(function() {
	function async_load(){
		var s = document.createElement('script'); s.type = 'text/javascript';
		s.src = ('https:' == document.location.protocol ? 'https://' : 'http://') + piHostname + '/pd.js';
		var c = document.getElementsByTagName('script')[0]; c.parentNode.insertBefore(s, c);
	}
	async_load();
})();



    _linkedin_partner_id = "669017";
    window._linkedin_data_partner_ids = window._linkedin_data_partner_ids || [];
    window._linkedin_data_partner_ids.push(_linkedin_partner_id);
    

Requests	IP Address	Location	AS Autonomous System
49	13.32.121.84	New York, New York, United States	AS16509AMAZON-02
15	146.75.122.132	Frankfurt am Main, Hesse, Germany	AS54113FASTLY
2	65.9.175.33	United States	AS16509AMAZON-02
2	104.18.41.175	United States	AS13335CLOUDFLARENET
2	23.56.205.206	Frankfurt am Main, Hesse, Germany	AS16625AKAMAI-AS
2	95.100.110.30	Frankfurt am Main, Hesse, Germany	AS20940Akamai International B.V.
2	142.250.186.170	United States	AS15169GOOGLE
1	13.32.121.117	New York, New York, United States	AS16509AMAZON-02
1	65.9.175.37	United States	AS16509AMAZON-02
1	65.9.175.126	United States	AS16509AMAZON-02
79	50	-	-

Security Scan Report: detectify.com

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies3

Content Similarity HashesFor malware variant detection

Image Hashes

Perceptual Hashes

Other Hashes

Scan History