Using API calls, you can manage the settings of the Scanner, download and delete the list of detected vulnerabilities re-check the previously recorded events (Recheck).
Settings are managed using specially designed queries. The general conventions (authorization, response codes, the *_hash methods and paginated selection) are described in the relevant section.
Available only for the
Enterpriseplan.
Request example:
curl http://api.example.com:8080/scanner/v1/get_scanner_settings --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response format:
{
"status": "success",
"timestamp": integer,
"active": boolean,
"scan_proxy": string,
"scan_schedule": [object, ...],
"comment": string,
"targets": [object, ...]
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Response example:
{
"status": "success",
"timestamp": 1730986421,
"active": true,
"scan_proxy": "http://example.com:3128",
"scan_schedule": [
{"weekday": 0, "hour": 3, "minute": 0},
{"weekday": 1, "hour": 3, "minute": 0},
{"weekday": 1, "hour": 15, "minute": 30}
],
"comment": "my settings",
"targets": [
{
"active": true,
"target": "http://example.com",
"auth_params": {
"active": true,
"path": "/login.php",
"username_field": "username",
"username_value": "admin",
"password_field": "password",
"password_value": "YOUR_PASSWORD"
},
"exclude_modules": ["ba", "ca", "lfi", "rce", "rfi", "sde", "sqli", "ssti", "xss"]
}
]
}
timestamp - the date of the last configuration change in the Unix Timestamp format.The value of the parameter is transmitted in its entirety and completely replaces the previously saved one.
Request example:
curl http://api.example.com:8080/scanner/v1/set_scanner_settings --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"set": {
"active": true,
"scan_proxy": "http://example.com:3128",
"scan_schedule": [
{"weekday": 0, "hour": 3, "minute": 0},
{"weekday": 1, "hour": 3, "minute": 0},
{"weekday": 1, "hour": 15, "minute": 30}
],
"comment": "my settings",
"targets": [
{
"active": true,
"target": "http://example.com",
"auth_params": {
"active": true,
"path": "/login.php",
"username_field": "username",
"username_value": "admin",
"password_field": "password",
"password_value": "YOUR_PASSWORD"
},
"exclude_modules": ["sqli", "xss", "rce", "lfi", "rfi"]
}
]
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
If the value is false, the settings are deactivated.
"active": true
The address of the proxy server used for the classic scan and for recheck, in the format schema://host[:port].
The proxy is shared: it is set once for all targets and is not a target parameter. If the value is empty, requests go directly.
"scan_proxy": "http://proxy.example.com:3128"
The schedule of the classic scan. Each item is one launch. The same weekday may be listed more than once, so the scan can run several times a day.
Time is the local time of the server where the Scanner is running.
weekday — day of week: 0 is Sunday, 1 is Monday, …, 6 is Saturday;hour — hour, 0–23;minute — minute, 0–59.All three fields are required in each item. An empty array, or omitting the key, means the classic scan is not started on a schedule. A single object is accepted as one launch.
Only one classic scan can run at a time. Recheck runs independently of this schedule.
"scan_schedule": [
{"weekday": 0, "hour": 3, "minute": 0},
{"weekday": 1, "hour": 15, "minute": 30}
]
The option defines the list of scanning targets and their parameters.
Required:
target - the scanning target in the format schema://host[:port]. The path cannot be used.
Optional:
active - the activity of the target. If the value is false, the target is not scanned;
auth_params - the authorization parameters used to scan the sections that require authentication;
exclude_modules - the list of modules that are not involved when working with the target.
"targets": [
{
"active": true,
"target": "http://example.com",
"exclude_modules": ["sqli", "xss"]
},
{
"active": true,
"target": "https://web.example.com:8443"
}
]
The option defines the authorization parameters that allow the Scanner to check the sections of the web application that are available only to authorized visitors:
active - the activity of the authorization functionality;path - the path (for example, /login.php) or the full URL of the authorization page;username_field - the name of the field for the user name;username_value - the user name;password_field - the name of the field for the password;password_value - the user password.Use a separate account with the minimum required privileges for scanning.
"auth_params": {
"active": true,
"path": "/login.php",
"username_field": "username",
"username_value": "admin",
"password_field": "password",
"password_value": "YOUR_PASSWORD"
}
The option defines the list of scanning modules that are not involved when working with the target.
The following modules are available: ba, ca, crlf, csp, csrf, dcms, hhi, lfi, nosqli, rce, redirect, rfi, sde, sqli, ssrf, ssti, voc, xss, xxe.
"exclude_modules": ["sqli", "xss", "rce"]
Comment.
"comment": "my settings"
The method allows you to check whether the data has changed without downloading it in full. More detailed information is available in the relevant section.
Request example:
curl http://api.example.com:8080/scanner/v1/get_scanner_settings_hash --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response example:
{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Request example:
curl http://api.example.com:8080/scanner/v1/set_scanner_settings --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"del": ""
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Request example:
curl http://api.example.com:8080/scanner/v1/get_vulns --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"startTime": 1730986421,
"endTime": 1730987421,
"limit": 100,
"offset": 0,
"reverseOrder": false,
"iid": ["abad7224dfef6baee9434d470d96e3c4"],
"type": ["ba"],
"severity": ["High"],
"description": ["Broken Access"],
"schema": ["http"],
"host": ["example.com"],
"port": [80],
"method": ["get"],
"mz": ["query"],
"path": ["/index.php"],
"data": ["abc"],
"payload": ["abc"],
"curl": ["example.com"]
}'
Optional parameters:
startTime and endTime - the start and end date in the Unix Timestamp format for which information will be requested;limit, offset and reverseOrder - the parameters of the paginated selection;iid - the unique identifier of the agent. The search is performed according to the strict correspondence of each element of the list;type - the module that recorded the event. The search is performed according to the strict correspondence of each element of the list;severity - the severity level of the event. The search is performed according to the strict correspondence of each element of the list;description - the description of the event. The search is performed according to the strict correspondence of each element of the list;schema - the request schema. The search is performed according to the strict correspondence of each element of the list;host - host, domain name. The search is performed according to the strict correspondence of each element of the list;port - the port. The search is performed according to the strict correspondence of each element of the list;method - the method of sending an HTTP request. The search is performed according to the strict correspondence of each element of the list;mz - the zone in which the event was detected: path, query, body, cookie, user-agent, referer, other_headers. The search is performed according to the strict correspondence of each element of the list;path - the request path. The search is performed based on the occurrence of each item in the list;data - the contents of a part of the payload. The search is performed based on the occurrence of each item in the list;payload - the payload. The search is performed based on the occurrence of each item in the list;curl - the contents of the cURL request used to reproduce the event. The search is performed based on the occurrence of each item in the list.The value
nullis not allowed forid,timestampandhost.
Response format:
{
"status": "success",
"count": integer,
"totalCount": integer,
"cid": string,
"vulns": [
{
"id": integer,
"iid": string,
"timestamp": integer,
"type": string,
"severity": string,
"description": string,
"schema": string,
"host": string,
"port": integer,
"method": string,
"mz": string,
"path": string,
"data": string,
"payload": string,
"curl": string
},
...
]
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
count - the number of records returned based on the limit option limit;totalCount - the total number of records based on the search criteria;cid - the identifier of the Mikiri WAF cluster;curl - the cURL request that allows you to reproduce the detected vulnerability.A module records a finding when its own check confirms the condition below. The type of a finding is the module name. csp chooses the severity per finding. dcms writes to the scan log and does not record a finding.
|
Module |
Description |
Severity |
| ba |
Broken access. After a signed-in request has shown a page that an anonymous request is refused, the module repeats the anonymous request with a rewritten path or a forwarding header. A finding is recorded when that request returns the same authenticated page. |
High |
| ca |
Cookie analysis. The module reads the cookies of a successful response. A missing |
Low |
| crlf |
CRLF injection. The module places a carriage return and a line feed in a parameter. A finding is recorded when the response gains a header that a benign value in the same place does not set. |
Medium |
| csp |
Content Security Policy. The module reads the enforcing |
Low to High |
| csrf |
Cross-site request forgery. The module looks at state-changing |
Medium |
| dcms |
CMS detection. The module matches the response against CMS fingerprints, then reads a version from the public files of WordPress, Joomla or Drupal and from a WordPress plugin |
— |
| hhi |
Host header injection. The module names a marker host in a forwarding header or in the Host header. A finding is recorded when that host appears in a link or a redirect and is absent when the request carries no such header. The scanner still connects only to the target. |
Medium |
| lfi |
Local file inclusion, including unrestricted file upload. The module places a local-file reference in a parameter. A finding is recorded when signatures of that file appear in the response and are absent from the unmodified page. An upload is recorded when a file accepted by an upload form can afterwards be requested. |
High |
| nosqli |
NoSQL injection. The module places a query metacharacter in a parameter. A finding is recorded when a database driver error appears and is absent from the unmodified page and from the same parameter filled with a benign value. |
High |
| rce |
Remote code execution. The module places a command in a parameter. A finding is recorded when the expected output is absent from the unmodified page and from the same parameter filled with a benign value. |
High |
| redirect |
Open redirect. The module places an external address in a parameter. A finding is recorded when the response sends the browser to that host and a same-site value in the same place does not. The scanner does not follow the redirect. |
Medium |
| rfi |
Remote file inclusion. The module places the address of a remote resource in a parameter. A finding is recorded when a marker from that resource appears in the response body and is not part of the request URL. |
High |
| sde |
Sensitive data exposure. A crawled address whose path ends with a suffix from the sensitive-data wordlist is requested without following redirects, and only the start of the body is read. A finding is recorded when the response is |
High for data and credentials, Low for the others |
| sqli |
SQL injection. Three checks, each recorded as High. Error-based: a database error appears after the probe, and a benign value in the same place does not produce it. Time-based: the probe is slower than a benign request measured in the same period, and the difference repeats. Union-based: a marker comes back from the query result outside the text of the probe. |
High |
| ssrf |
Server-side request forgery. The module probes parameters whose name or value looks like a URL. A finding is recorded when distinctive tokens of a fetched resource appear only in the probe response: they are absent from the original page, from the same parameter filled with a benign URL, and from the probe itself. |
High |
| ssti |
Server-side template injection. The module places a template expression in a parameter for Twig, Jinja2, Jinjava, ASP.NET Razor, Ruby, Hubspot or PugJs. A finding is recorded when the evaluated marker appears and the original page did not contain it. |
High |
| voc |
Vulnerable and outdated components. The module reads the |
High for PHP, Medium for the others |
| xss |
Cross-site scripting. The module places a marker in a parameter, a header, the path, |
Medium |
| xxe |
XML external entity. The module sends an XML document that references an external entity, in a parameter or as a raw XML body. A finding is recorded when file contents appear in that response and are absent from the baseline response and from the document that was sent. |
High |
The severity field of a detected vulnerability is High, Medium or Low. For csp the value depends on the finding. dcms has none.
Vulnerabilities can be deleted by record identifier, by all set to true, or by any combination of type, severity, schema, host, port, method and older. At least one criterion is required: a request that contains only the product key does not delete anything. all set to true deletes every finding of the CID and counts as that criterion.
older is a positive integer, the age in days. Findings whose timestamp is older than this number of days are deleted.
Request example:
curl http://api.example.com:8080/scanner/v1/del_vulns --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"type": ["sqli", "xss"],
"severity": ["high"],
"schema": ["https"],
"host": ["example.com"],
"port": [443],
"method": ["GET"],
"older": 7
}'
Deleting chosen records by identifier is also supported:
curl http://api.example.com:8080/scanner/v1/del_vulns --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"id": [1, 2, 3]
}'
Optional parameters:
id - the identifiers of the entries in the api database. Required when no other criterion is set;all - true deletes every finding of the CID. Combined with other parameters, those parameters still apply;type - the module that recorded the event. The search is performed according to the strict correspondence of each element of the list;severity - the severity level of the event. The search is performed according to the strict correspondence of each element of the list;schema - the request schema. The search is performed according to the strict correspondence of each element of the list;host - host, domain name. The search is performed according to the strict correspondence of each element of the list;port - the port. The search is performed according to the strict correspondence of each element of the list;method - the method of sending an HTTP request. The search is performed according to the strict correspondence of each element of the list;older - a positive integer, the age in days. Findings whose timestamp is older than this number of days are deleted.Different parameters are combined according to the logical
ANDprinciple the values within one parameter - according to the logicalORprinciple. String values are case-insensitive.portmatches exactly.If no criterion is set, the request is rejected and no findings are deleted.
Response example:
{"status": "success", "deleted": 3}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
deleted - the number of deleted findings.These calls queue a classic scan of one saved target and report whether it is still waiting or running. The Scanner reads the queue and starts the target when no classic scan is running. Only one classic scan runs at a time.
Request example:
curl http://api.example.com:8080/scanner/v1/set_scan --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"target": "https://example.com"
}'
Response format:
{"status": "success", "scan": "queued"}
scan - queued when the command was accepted or was already waiting, running when that target is already being scanned.The target must be a URL already stored in targets. An unknown or empty target returns fail.
Request example:
curl http://api.example.com:8080/scanner/v1/get_scan --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response format:
{
"status": "success",
"scan": [
{"target": "https://example.com", "state": "queued"}
]
}
state - queued or running.No rows returns {"status": "none"}.
Used by the Scanner. running marks the target as being scanned. done removes it.
Request example:
curl http://api.example.com:8080/scanner/v1/set_scan_status --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"target": "https://example.com",
"state": "running"
}'
Response format:
{"status": "success", "scan": "running"}
The Recheck functionality allows you to check whether the events previously recorded by the Mikiri WAF agents are exploitable. Only the events that belong to the cluster of the transmitted license key are accepted for the queue.
Recheck is always enabled on the Scanner. There is no settings flag to turn it off. Each cycle reads the queue and finishes immediately when the queue is empty. If scan_proxy is set, recheck uses that proxy.
Request example:
curl http://api.example.com:8080/scanner/v1/set_recheck --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"ids": [1, 2]
}'
Required parameters:
ids - the identifiers of the entries in the database of events for which the re-check must be performed.Response example:
{"status": "success", "recheck": 2}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
recheck - the number of events queued.Request example:
curl http://api.example.com:8080/scanner/v1/get_recheck_status --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response format:
{
"status": "success",
"recheck": {
"%ID%": boolean
}
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Response example:
{
"status": "success",
"recheck": {
"1": true,
"2": false,
"3": null
}
}
%ID% is the identifier of the entry in the database of events. The following values are possible:
null - the event has not been processed;false - the vulnerability has not been confirmed;true - the vulnerability has been confirmed.