Crawling a website (Discovery settings)

In Vooki Pro, crawling is part of the Discovery step of every web scan. You control what gets mapped and how long it takes. Every URL the crawler finds is shown on the scan's Sitemap tab.

Choose a discovery strategy

Quick scan: no crawl, only the URL you entered.
Crawl website: follows links from the start URL.
Use recording: replays a browser session you recorded.
Hybrid: replays a recording, then crawls outward from its URLs. Use this for single-page apps.

Crawl settings

Setting	What it does
Crawl depth	How many links deep to follow, from 1 to 5. The default is 2.
URLs to scan	All, or a cap of 50, 100, 150 or a custom number.
URLs at once	How many crawled URLs are scanned in parallel (1, 2, 3, 5 or 8). Higher is faster but loads the target more.
Max crawl duration	Unlimited, or 1, 5, 15, 30 or 60 minutes. Whatever was found by then is still tested.
Discover background / API requests	Runs a headless browser pass that captures the XHR and fetch calls the page makes. A plain crawler reads links from HTML and never runs your JavaScript, so without this it misses most REST endpoints.
Test state-changing methods	Also tests PUT, PATCH and DELETE requests from a recording. It is off by default because these can change or delete data.

Keep the crawler in scope

Host scope is set on the Target step (Same Host, Same Domain, Custom Hosts or All Detected Hosts). Within that, two wildcard lists narrow the crawl, with one pattern per line:

Discovery include: only crawl URLs that match, for example */app/*.
Discovery exclude: never crawl these, for example */logout or *.pdf.

Matching is forgiving: */login also matches /login/, /login?next=… and /login.php.

Discovery filters decide what gets found. The Attack include / exclude filters on the Policy step decide what gets attacked. To map a page but never send it payloads, leave it in discovery and exclude it under Attack Scope.

Crawling a site behind a login

Authentication is set on the Auth step. For the most reliable result, record yourself logging in and use Login via recording with Auto re-login enabled. Always add the logout URL to Discovery exclude, or the crawler will log itself out.

The crawl found very few URLs

Single-page app? Switch to Hybrid with a recording.
Check that Discover background / API requests is ticked.
Increase the crawl depth or the max crawl duration.
Check the scan's Logs for WAF blocks or a login that expired.