> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vigolium.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Native Scan Phases

> Run Vigolium's native scan phases independently, skip specific phases, or chain them into a custom pipeline.

## Overview

Vigolium's native scan pipeline consists of multiple phases that run sequentially. You can run the full pipeline, isolate a single phase with `--only`, or skip specific phases with `--skip`. This guide walks through each phase and how to run them independently.

## The Full Pipeline

When you run a standard scan, phases execute in this order:

1. **External Harvest**: gather endpoints from external sources (Wayback Machine, CommonCrawl, AlienVault, urlscan, VirusTotal)
2. **Discovery**: content discovery via wordlists and fuzzing
3. **Spidering**: browser-based crawling to discover dynamic content
4. **Known Issue Scan**: template-based scanning with Nuclei + Kingfisher secret detection
5. **Dynamic-Assessment**: active and passive vulnerability scanning modules

A full scan with all phases enabled:

```bash theme={null}
vigolium scan -t https://example.com --discover --spider --external-harvest --known-issue-scan
```

> Source-aware whitebox analysis (SAST, code audit, route extraction) lives in agent mode now, see [Agentic Scanning](https://docs.vigolium.com/guides/agentic-scan).

## Running a Single Phase

Use `vigolium run <phase>` or `vigolium scan --only <phase>` to execute one phase in isolation.

### Probe

A host sweep: one request per target, passive fingerprinting and attack-surface scoring, no content discovery and no fuzzing. Built for host lists in the thousands, where `run discovery` would spend its whole budget on the first handful.

```bash theme={null}
vigolium run probe -T hosts.txt -c 20
```

Sweep with JSONL on stdout and TLS certificates:

```bash theme={null}
vigolium run probe -T hosts.txt --json --no-response --tls-probe
```

The aliases `probing`, `httpx`, `alive`, and `sweep` all work. A probe-only run flips its own defaults - redirect hops recorded, `--redirect-mode same-apex`, proactive WAF pacing off - see [Probe](https://docs.vigolium.com/native-scan/phases/probe.md) for the full flag surface and the `surface_score` model.

### Fingerprint

Added in v0.5.5. Where probe asks *which* hosts are alive, fingerprint asks what one origin **is** — base page, favicon, well-known and API-definition paths, GraphQL introspection, CORS preflight, `OPTIONS`, Host-header variants, and a three-random-path not-found baseline — and stores the answer per `host:port`.

```bash theme={null}
vigolium run fingerprint -T hosts.txt --fingerprint-depth light
vigolium fingerprint https://app.example -j        # the same phase, as its own command (--depth)
```

Reads only (GET, OPTIONS, one GraphQL introspection POST), no redirects followed. Read the stored facts back with `vigolium hosts`; see [Host facts](https://docs.vigolium.com/others/cli-references.md#host-facts-fingerprint-hosts-dns). Aliases: `fp`, `tech`, `recon`.

### Discovery

Discovers new endpoints through wordlist-based fuzzing and content probing:

```bash theme={null}
vigolium run discovery -t https://example.com
```

Equivalent to:

```bash theme={null}
vigolium scan -t https://example.com --only discovery
```

Tune discovery with additional flags:

```bash theme={null}
vigolium run discovery -t https://example.com \
  --discover-max-time 30m \
  -c 100 \
  --rate-limit 200
```

### Spidering

Crawls the target using a headless browser to discover pages, forms, and JavaScript-rendered content:

```bash theme={null}
vigolium run spidering -t https://example.com
```

Control the browser engine and parallelism:

```bash theme={null}
vigolium run spidering -t https://example.com \
  -E chromium \
  -b 3 \
  --spider-max-time 20m \
  --no-forms
```

The alias `spitolas` also works:

```bash theme={null}
vigolium run spitolas -t https://example.com
```

### External Harvest

Pulls endpoints from external intelligence sources (Wayback Machine, certificate transparency logs):

```bash theme={null}
vigolium run external-harvest -t https://example.com
```

### Known Issue Scan

Runs template-based scanning (Nuclei templates) against ingested endpoints:

```bash theme={null}
vigolium run known-issue-scan -t https://example.com
```

Filter templates by severity or tags:

```bash theme={null}
vigolium run known-issue-scan -t https://example.com \
  --known-issue-scan-severities critical,high \
  --known-issue-scan-tags cve,rce
```

### Dynamic-Assessment

Runs active and passive vulnerability scanning modules. This is the core scanning phase (formerly named `audit`).

```bash theme={null}
vigolium run dynamic-assessment -t https://example.com
# alias also works:
vigolium run audit -t https://example.com
```

Select specific modules or tags:

```bash theme={null}
vigolium run dynamic-assessment -t https://example.com -m xss -m sqli
vigolium run dynamic-assessment -t https://example.com --module-tag injection
```

### Extension

Runs only custom JavaScript or YAML extensions:

```bash theme={null}
vigolium run extension -t https://example.com --ext ./my-checks.js
```

## Skipping Phases

Use `--skip` to disable specific phases while keeping the rest of the pipeline:

```bash theme={null}
# Run everything except spidering
vigolium scan -t https://example.com --discover --skip spidering

# Skip both spidering and known-issue-scan
vigolium scan -t https://example.com --discover --skip spidering --skip known-issue-scan
```

Note: `--only` and `--skip` cannot be used together.

## Phase Aliases

Every phase accepts shorthand aliases - the gerund, the internal engine name, and the vocabulary of the tool it replaces. Canonical names are listed first.

| Canonical Phase | Aliases |
| - | - |
| `ingestion` | `ingest`, `ingesting` |
| `probe` | `probing`, `httpx`, `alive`, `sweep` |
| `fingerprint` | `fp`, `tech`, `recon` |
| `discovery` | `discover`, `discovering`, `deparos` |
| `external-harvest` | `harvest`, `harvesting`, `external-harvester` |
| `spidering` | `spider`, `spitolas`, `crawl`, `crawling`, `crawler` |
| `known-issue-scan` | `cve`, `kis`, `known-issue`, `known-issues` |
| `dynamic-assessment` | `dast`, `audit`, `assessment`, `assess` |
| `extension` | `ext`, `extensions` |

Run `vigolium strategy --json` for the authoritative list - it is generated from the same registry the flags are validated against, so `phases[].canonical` and `phases[].aliases` are exactly what `--only`, `--skip`, and `run <phase>` accept.

## Chaining Phases Manually

You can chain independent phase runs to build a custom pipeline. Each phase stores its results in the database, so subsequent phases pick up where the previous one left off:

```bash theme={null}
# Step 1: Discover endpoints
vigolium run discovery -t https://example.com

# Step 2: Dynamic-assessment over the discovered endpoints
vigolium run dynamic-assessment -t https://example.com

# Step 3: Run custom extensions against results
vigolium run extension -t https://example.com --ext ./custom-check.js
```

## Tuning Per-Phase Performance

Override concurrency and rate limits for individual phases using the config file (`vigolium-configs.yaml`):

```yaml theme={null}
scanning_pace:
  concurrency: 25
  rate_limit: 100

  discovery:
    concurrency: 100
    duration_factor: 1.0

  spidering:
    max_duration: 20m

  dynamic-assessment:
    parallel_passive: true
```

CLI flags (`-c`, `--rate-limit`) always take precedence over config values.

## Controlling Scope

Scope filtering applies across all phases. Use `--scope-origin` to control host matching:

```bash theme={null}
# Strict: exact host match only
vigolium run discovery -t https://api.example.com --scope-origin strict

# Balanced (default): same eTLD+1 (*.example.com)
vigolium run discovery -t https://api.example.com --scope-origin balanced

# Relaxed: candidate's registrable label contains the target's - brand-wide recon
vigolium run discovery -t https://api.example.com --scope-origin relaxed
```

> [!WARNING]
>
> **The default is `balanced` as of v0.4.9** (it was `relaxed`), and `--scope-origin` also decides which **stored** records a phase picks up, not just which new traffic is allowed. On a project database that already holds earlier scans, `balanced` re-scans every sibling host sharing the target's eTLD+1 - and sorts them *ahead* of the target you just named. See [Host scope](https://docs.vigolium.com/native-scan/scan-scope.md#host-scope) for the full table and the isolation options.

## Adding Authentication

All phases respect authentication headers. Pass them with `-H`:

```bash theme={null}
vigolium run dynamic-assessment -t https://api.example.com \
  -H 'Authorization: Bearer eyJhbGciOi...' \
  -H 'Cookie: session=abc123'
```

For multi-session testing (e.g., IDOR detection), use session configs:

```bash theme={null}
vigolium run dynamic-assessment -t https://api.example.com \
  --auth-file sessions.yaml
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.