Some of the most sensitive parts of an application, such as checkout, onboarding, multi-step forms and approval flows, are hard for a crawler to reach. Recording the journey once in a browser lets a scanner replay and test it every time.

How it works

You open the application in a recording browser and perform the journey: log in, add to cart, fill the forms. The recording captures every request. The scanner replays it to reach the deep pages, then tests the inputs it found along the way.

Why it matters

• Deep, multi-step workflows often contain the most valuable functions.
• Crawlers stop at forms that need realistic, valid input.
• Recordings make scans repeatable for every release.

Best practices

• Record the journeys that handle money, personal data and permissions.
• Use test accounts and test payment details.
• Re-record when the user interface changes significantly.
• Combine recordings with crawling to cover the rest of the site.

How Vooki Pro helps

• Records browser sessions and keeps them in a recordings library for reuse.
• Replays the recorded method, body and headers so scans reach the same deep pages.
• Can use a recording as the login step for authenticated scans.
• Imports HAR files and exports recordings as HAR for sharing.

Frequently asked questions

What is a browser recording in DAST?

A captured sequence of user actions and requests that the scanner replays to reach deep pages and test their inputs.

Can I import a HAR file?

Yes, in scanners that support it. A HAR file from your browser's developer tools captures a journey's requests.

Related: Scanning single-page applications (React, Angular, Vue) · How to security-test a REST API from OpenAPI or Postman