Internal Network Scanning¶

Internal Assets hosted within private networks or behind firewalls can be scanned through the use of Private Locations and scanner identification mechanisms. This capability is applicable to both WebApp DAST and API DAST scanning modes.

Overview¶

Internal application scanning addresses scenarios where:

Applications are hosted on private networks without public internet access
Web Application Firewalls (WAFs) or Intrusion Detection Systems (IDS) must differentiate scanner traffic from malicious requests
Access to specific endpoints or introspection capabilities is restricted to authorized security testing tools
Monitoring systems require exemption rules for security testing traffic

Scanner Identification¶

Sec-Escape-User Header¶

Escape's API DAST and WebApp DAST HTTP requests carry an Escape-specific header, Sec-Escape-User. Server-side logic can use it to identify security testing traffic. You don't need to provision a token or configure this header.

Header Format:

Sec-Escape-User: {{simulated-user}}

The value identifies which simulated user sent the request (for example public, or a named user from your authentication configuration). API DAST and WebApp DAST use the same header. AI Pentesting browser traffic also supports it; raw ASM probes don't carry HTTP headers.

Use Cases for Scanner Identification¶

Web Application Firewall (WAF) Allowlisting:

Security appliances can recognize the Sec-Escape-User header and exempt scanner traffic from rate limiting, blocking rules, or alert generation. This prevents false positive security alerts and keeps scans running. Because HTTP headers can be spoofed, Sec-Escape-User on its own is fine for tagging traffic but not for allowlisting: pair it with a source IP match or a shared-secret header. See Firewall Configuration for the recommended allowlist rules.

Conditional Introspection Access:

Server introspection endpoints (GraphQL introspection, OpenAPI documentation, API metadata) can be restricted to requests containing valid scanner identification. This allows security testing in staging environments while maintaining endpoint restrictions in production.

Monitoring Exemption:

Application Performance Monitoring (APM) and observability systems can filter scanner traffic from metrics, logs, and alerting pipelines, preventing distortion of production telemetry.

Selective Feature Enablement:

Application logic can detect scanner presence and enable specific behaviors such as:

Expanded error messages for vulnerability identification
Disabled CAPTCHA challenges
Relaxed rate limiting for comprehensive coverage
Test data population for business logic testing

Never allowlist on the header alone

Because HTTP headers can be spoofed, never let traffic bypass your WAF on the presence of Sec-Escape-User alone. An attacker who learns your WAF trusts the header can simply send it. Always combine it with an IP allowlist or a shared secret, as described in Firewall Configuration.

Custom Header Configuration¶

When you need an additional identification signal, for example a shared secret to allowlist on, configure custom headers. They are sent on every request alongside Sec-Escape-User and apply to both WebApp DAST and API DAST scans.

Custom headers live under the top-level network key in the scan configuration:

network:
  custom_headers:
    X-Escape-WAF-Bypass:
      - '<your-long-random-secret>'

You can set them in your organization-wide defaults or in Settings > Scan configuration > Expert for a DAST profile. Scan-level values override defaults. See Firewall Configuration for how to allowlist on a shared-secret header.

Private Location Configuration¶

Private Locations enable scanning of applications that aren't accessible from the public internet. The Escape Repeater agent establishes an outbound connection from the private network to the Escape platform, allowing bidirectional communication for scan execution.

Private Location Architecture¶

Repeater Agent: Lightweight agent deployed within the private network
Outbound Connection: SSH tunnel initiated from the private network to private-location.escape.tech on TCP port 2222
Request Proxying: Scanner requests are transmitted through the established tunnel to internal applications
Response Transmission: Application responses are returned through the tunnel for analysis

Configuring Private Locations¶

For New Applications (Dashboard)¶

When creating an application through the Escape dashboard:

Navigate to the application creation workflow
In the Fine-Tune (Optional) step, open Location and select a previously configured Private Location
Proceed with standard application configuration (URL, authentication, scan settings)

Private Location selection is independent of application type (WebApp DAST or API DAST).

For New Applications (Public API)¶

Applications with Private Location assignments can be created programmatically through the Public API. Refer to the Public API Documentation for endpoint specifications and request schemas.

For Existing Applications¶

To configure an existing application for internal scanning:

Navigate to the application's settings in the Escape dashboard
Open Scan configuration > Location
Choose a Private Location from the available options
The selection saves automatically

Subsequent scans use the selected Private Location for network connectivity.

Private Location Management¶

Private Locations must be configured and registered before they can be assigned to applications. Configuration and management of Private Locations is performed through the Organization Settings - Private Locations interface.

Prerequisites:

Repeater agent deployment within the target network
Network egress rules permitting outbound SSH on TCP 2222 and HTTPS access to the Escape Platform API. See the Firewall Egress Rules
Appropriate DNS resolution for Escape platform endpoints
Sufficient agent resources for concurrent scan execution

Security Considerations¶

Network Isolation¶

Private Location deployments use an outbound SSH tunnel on TCP 2222 to carry scan traffic. The agent also uses outbound HTTPS for Escape Platform API calls. You don't need to expose your target application to the public internet.

Authentication Layering¶

Configure scanner identification headers for network access and application-level credentials for authenticated testing. Each serves a distinct purpose: the headers identify scan traffic, and the credentials provide access as your test users.

Secret Rotation¶

If you allowlist on a shared-secret custom header, rotate the secret periodically as part of security hygiene practices. Rotation requires coordinated updates to:

WAF allowlist configurations
Any server-side logic that checks the header
Monitoring exemption rules

Applicable Scan Types¶

The capabilities described in this document apply equally to:

WebApp DAST: Browser-based scanning of web applications and Single Page Applications (SPAs)
API DAST: Direct HTTP-based testing of REST APIs, GraphQL APIs, and other API architectures

Configuration syntax and private location behavior remain consistent across scan types.