How Scanning Works
This page explains how Ryft discovers your assets and tests them for vulnerabilities in plain language.
The Two Phases of Scanning
Ryft scans operate in two phases:
Phase 1: Reconnaissance (Discovery)
The first phase is all about discovery — finding out what assets exist on the internet that belong to your domain. Ryft uses a combination of active and passive techniques:
Active Discovery
Subdomain enumeration — Ryft queries multiple data sources to discover subdomains of your domain (e.g.,
mail.example.com,api.example.com,staging.example.com).Live host detection — Once subdomains are found, Ryft probes each one to determine which are actually serving web content, along with their HTTP status codes, page titles, and IP addresses.
Port scanning — Ryft identifies which network ports are open on your assets, revealing exposed services like SSH, databases, or web servers.
Virtual host discovery — Identifies additional websites hosted on the same IP addresses.
Directory and file discovery — Ryft brute-forces common directory and file paths on your web servers to uncover hidden or unlinked content.
All reconnaissance results appear on the Results Dashboard for each domain.
Passive Intelligence (No Traffic to Your Targets)
These sources gather intelligence without sending any requests to your infrastructure:
Internet-wide service indexing — Ryft queries internet-wide scan databases to find IP addresses, open ports, and services associated with your domain that are already publicly indexed.
Threat intelligence feeds — Open threat intelligence platforms provide associated domains, URLs, and threat data linked to your assets.
Certificate transparency monitoring — Ryft monitors public SSL certificate logs to discover subdomains that have had certificates issued for them.
WHOIS correlation — Finds other domains registered with similar registration information, helping identify related assets you may not be aware of.
Historical URL archives — Ryft collects known URLs from web archives and crawl databases to find historical and potentially forgotten endpoints, API paths, and parameters.
Phase 2: Vulnerability Testing
After reconnaissance maps your attack surface, the second phase tests discovered assets for security weaknesses. Each vulnerability module focuses on a specific class of issue (see the Vulnerability Dashboard for how to run these):
General Vulnerability Scan — Comprehensive security testing using thousands of detection templates that cover known vulnerabilities, misconfigurations, default credentials, exposed panels, and CVEs.
Sensitive Files — Checks for accidentally exposed files like
.env,.git/config, backup files, and admin panels.JavaScript Secrets — Scans JavaScript source code for leaked API keys, tokens, passwords, and credentials.
XSS (Cross-Site Scripting) — Tests for reflected and DOM-based script injection vulnerabilities.
SSRF (Server-Side Request Forgery) — Tests whether servers can be tricked into making requests to internal resources.
Directory Traversal — Checks if attackers can access files outside the intended web directory.
Open Redirect — Detects redirect endpoints that could be abused for phishing.
Subdomain Takeover — Identifies dangling DNS records pointing to unclaimed cloud services that an attacker could claim.
Custom Templates — Runs your own custom vulnerability detection templates for testing specific to your environment. See Custom Templates.
Hygiene Checks assess your security configuration rather than testing for exploitable vulnerabilities:
DNS Security — Verifies SPF, DKIM, DMARC, DNSSEC, and CAA records are properly configured to prevent email spoofing and DNS attacks.
TLS/SSL — Checks certificate validity, cipher strength, protocol versions, and OCSP stapling configuration.
Security Headers — Verifies HTTP security headers like Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, and Permissions-Policy.
Cloud Scanning discovers misconfigured cloud resources (see Cloud Modules):
S3 Buckets — Finds publicly accessible Amazon S3 storage associated with your domain.
GCP Buckets — Finds publicly accessible Google Cloud Storage associated with your domain.
Cloud Inventory — Broad cloud infrastructure discovery across providers.
How Results Are Organized
Reconnaissance results appear on the Results Dashboard — subdomains, live hosts, IPs, passive OSINT data
Vulnerability results appear on the Vulnerability Dashboard — organized by module with severity ratings
Recon Insights appear on the Recon Insights page — AI-analyzed threats from reconnaissance data
Cloud results appear on the Cloud Modules page
All findings are also aggregated on the Findings page for a cross-domain view
Technologies detected across your assets appear on the Technologies page
Visual relationships are shown on the ASM Map
Severity Levels
Every finding is assigned a severity level:
Critical
Severe vulnerability that could lead to full system compromise. Immediate action required.
High
Significant security issue that poses real risk. Should be prioritized.
Medium
Moderate issue that should be reviewed and addressed in a reasonable timeframe.
Low
Minor finding with limited impact. Worth tracking but not urgent.
Info
Informational finding. Not a vulnerability, but useful context about your assets.
Deduplication
Ryft automatically deduplicates findings across scans. If the same vulnerability is found in multiple scans, it's stored once and linked to the most recent scan. This prevents your Findings list from being cluttered with duplicate entries.
Rate Limiting
To avoid overwhelming your targets, Ryft supports configurable rate limiting profiles:
Conservative — Slower scanning with longer delays between requests. Best for production systems.
Moderate — Balanced speed and impact.
Aggressive — Faster scanning with shorter delays. Best for staging or test environments.
You can set the rate limiting profile when launching a scan or configuring a scheduled scan.
Real-Time Notifications
As scans run, Ryft sends real-time notifications:
In-app notifications — Appear in the notification bell in the top navigation
Email notifications — Sent to your verified email address (configurable in Settings)
Slack notifications — Sent to your configured Slack channel (Pro tier and above, configurable in Settings)
You'll be notified when:
A scan starts
A scan completes
New vulnerabilities are found
New assets are discovered
Cloud security issues are detected