Browser recordings

Some applications cannot be crawled. A single-page app builds its routes in JavaScript, a multi-step checkout only exists if you walk it, and anything behind a complex login is invisible to a scanner with only a URL. Browser recordings solve all three: you browse the application once, and that capture becomes the seed for the scan, complete with your authenticated session.

No proxy or certificate setup is needed. Vooki Pro opens its own Chromium window and listens to the browser's network events.

Record a session

Open Applications, select the application, and start a recording.
Vooki Pro opens a Chromium window. Log in and walk through the flows that matter: dashboard, search, checkout, admin screens.
Captured URLs appear live in a host and path tree in the Vooki Pro tab.
Click Stop when you are done, or close the Chromium window.

Nothing is attacked while you record. The scan only runs when you launch it.

Before scanning, click a few rows in the tree to confirm the recording caught the authenticated calls you wanted. If you missed a flow, record again.

Scan from the recording

In the recording's action bar, choose Use it as a web scan. Or start a new scan and pick the recording on the Discovery step.
On Discovery, choose one of these.
- Use recording tests exactly what you walked.
- Hybrid replays the recording, then crawls outward from its URLs. It gives the broadest coverage on single-page apps.
On Auth, the cookies from your recording are filled in automatically. Choose Login via recording and enable Auto re-login if session expires during scan for long scans.
Choose a policy, review, and click Launch scan.

Other things you can do with a recording

Build an API project turns the captured XHR and fetch calls into an API project for the API Builder.
Create a cookie auth profile saves the logged-in session for reuse in other scans.
Discard throws the recording away so you can record again.

HAR import and export

Import HAR on the Recordings screen brings in traffic captured in your browser's network tab or another tool. You can preview the entries and choose which to keep, then assign the recording to an application.
Export on any recording writes a .har file that imports straight back in.

The Recordings screen lists every recording across all applications, with Open, Rename, Export and Delete actions. If a recording's application was deleted, you can reassign it to another one.