Free Scan

Website scanning feature

Out of band application testing for websites

Some vulnerabilities leave no visible trace in the page. The application quietly contacts another system and the response looks normal. Out of band security testing, also called OAST, uses a controlled callback endpoint so a supported test can show that the target reached out. ScanTitan uses correlated DNS and HTTPS callbacks to help detect selected blind SSRF and XXE cases in eligible active website scans.

  • Correlated callbacks
  • Selected blind SSRF and XXE
  • Eligible active website scans

Start with a free account and see the website scan options. Registering does not activate paid features.

See website scan optionsHow callbacks work

Why blind vulnerabilities need a callback

In many injection flaws the application shows you the result. In a blind flaw it does not. A server-side request forgery can make a server fetch an internal or external address without showing the response, and an XML external entity flaw can make a parser load a resource the user never sees.

With nothing visible to compare, a scanner needs another way to know the target acted. An out of band callback gives that proof: the target is made to contact a system the scanner controls, and the contact itself is the evidence. Learn more about SSRF and XXE.

How out of band security testing works

  1. A supported test is sent. It is designed to make a vulnerable target contact a controlled endpoint.
  2. Each test is tied to an identifier. The callback can be matched to the exact test that caused it.
  3. The scanner listens for DNS and HTTPS callbacks. A matching callback shows that the target made the request.
  4. The result is reported as evidence. A correlated callback is different from an ordinary page response, because it proves the target initiated contact, not just that it returned a page.

Tokens and target details are removed from any evidence example, and test payloads are not published.

Scope and limits

Out of band testing supports selected cases. It is not a promise to find every blind injection family.
  • It runs in eligible standard or extended active website profiles.
  • Correlated DNS and HTTPS callback checks support selected blind SSRF and XXE cases.
  • Imported API scans do not use OAST. See the API vulnerability scanner for what API assessments cover.
  • A missing callback does not prove that a flaw is absent.
  • Only test websites you own or are authorized to test.

Out of band testing questions

What is out of band security testing?

It is a way to detect blind vulnerabilities. A test makes the target contact a controlled endpoint, and the callback is the evidence.

What is OAST?

OAST means out of band application security testing, the same technique described here.

Which vulnerabilities does it help detect?

Selected blind SSRF and XXE cases in eligible active website scans.

Does it work for API scans?

No. Imported API scans do not use OAST.

Can it find every blind injection?

No. It supports selected cases only.

Does a missing callback mean my site is safe?

No. The absence of a callback does not prove that a flaw is absent.

Is it safe to run on a live website?

Active tests send requests to the target. Use scan budgets and only scan sites you own or are authorized to test.

See the website scan options

Create a free account and review which scan profiles and plans fit your website.

See website scan optionsCompare plans

Other features

These ScanTitan features work alongside this one.

SPA Security ScannerBrowser scanning for JavaScript applicationsAuthenticated Linux ScannerPackage advisories over SSHBehavioral Malware DetectionRuntime behavior and visitor scenariosVulnerability PrioritizationCVSS, CISA KEV and EPSSAI Guided Website ScanningOptional AI guided checks for BusinessSecurity Scanning APIBusiness API and completion webhooksWebsite Up-time MonitorWebsite availability monitoring