# Target Configuration

Target configuration is an essential step to ensure the scan runs efficiently. It involves defining various settings, that help the scanner interact with your application according to your needs and use-case.  By making these adjustments, you can tailor the scan to match your specific needs and ensure it covers all the relevant parts of your application, ultimately leading to more reliable results.

## **Configuration**

This setting specifies the server location for the scanner.&#x20;

Choosing the right **scanner location** is one of the first things to consider. The server where the scanner runs should ideally be as close as possible to your target application. This reduces network latency, speeds up the scan, and minimizes disruptions that could affect the quality of the results. The closer the scanner server is to your target host, the more reliable and faster your scan will be.&#x20;

#### Scan Single Tab Session

Some applications—especially those in financial, banking, or high-security environments are designed to support **only a single browser tab session at a time**. If a user logs in and then opens the application in another tab, then the session may expire or get invalidated.

Enabling the **“Scan Single Tab Session”** option tells ZeroThreat to treat the application as a single-tab environment. This ensures that the scanner mimics real user behaviour by maintaining a single consistent session throughout the scan. It prevents session expiration or unexpected logouts.

<figure><img src="https://1825008717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fs6Y7hKb1RwZWFZo4EnUm%2Fuploads%2FFjJTLFt8xhqn5DRiejWj%2Fimage.png?alt=media&#x26;token=8f4d490f-d036-4958-97c2-54bd4330bc52" alt="" width="563"><figcaption></figcaption></figure>

## **Technology Stack**

This setting defines the technologies used in your application

The technology stack setting allows you to select both the front-end and back-end technologies used in your application, such as PHP, Java, Python, ASP.NET, etc.  For instance, if your application is built using PHP for the back-end and React for the front-end, selecting these technologies will help the scanner in multiple ways. This primarily enables **ZeroThreat AI** to tailors its remediation steps to the underlying techstack.

<figure><img src="https://1825008717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fs6Y7hKb1RwZWFZo4EnUm%2Fuploads%2FaSpcBlsBPV0CZmm2zCMV%2Fimage.png?alt=media&#x26;token=ce804099-69bf-4089-9015-12701750e964" alt=""><figcaption></figcaption></figure>

Different technologies have different security challenges and vulnerabilities. **ZeroThreat AI** can use this to provide the most relevant remediation steps.&#x20;

{% hint style="warning" %}
<mark style="color:orange;">**Avoid Misconfiguration**</mark>&#x20;

Misconfiguring could lead to irrelevant or incorrect recommendations.
{% endhint %}

## **Authentication Template**

This setting enables you to manage and create login sequences.

All the login steps recorded by **ZeroThreat Chrome Recorder**, will show up here. Here you can record new login sequences, ensuring the scanner has the necessary access to these restricted areas. Without this, traditional scanners won’t be able to scan these parts of your app like user dashboards, admin panels, and protected resources, leaving potential vulnerabilities undiscovered.

<figure><img src="https://1825008717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fs6Y7hKb1RwZWFZo4EnUm%2Fuploads%2Frm9otexTwRLzWcyKlAyI%2Fimage.png?alt=media&#x26;token=3e236426-ec9b-4dda-9b49-ecc566ea17fe" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
<mark style="color:green;">Use Descriptive Names with Version Numbers</mark>

When naming templates, include version numbers (e.g., "Admin Scan v1.0" or "Login Sequence v2.1"). This practice helps you track and manage template ensuring clarity when managing multiple versions.
{% endhint %}

## Allow Hosts&#x20;

This setting enables you to add external hosts that your application communicates with.&#x20;

**Allow Hosts** lets you specify external or internal hosts, APIs, and services that are part of your application but hosted on different domains. For example, if your app communicates with third-party APIs or authentication services, you’ll want to add those hosts to the scan scope. This ensures the scanner will test all the necessary interactions between your application and other external services, giving you a more complete security assessment.&#x20;

<figure><img src="https://1825008717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fs6Y7hKb1RwZWFZo4EnUm%2Fuploads%2F8lt5RAp7iuoLQEhwsWYY%2Fimage.png?alt=media&#x26;token=8bfe0970-3e5b-4962-a2da-0e67571c0004" alt=""><figcaption></figcaption></figure>

Omitting these from the scan could leave vulnerabilities in these external components unchecked, which could compromise your entire application.

## Request Headers

This setting allows you to add custom headers to HTTP requests made during the scan.&#x20;

Some applications require specific HTTP headers to interact with the back-end properly, such as authorization tokens, API keys, or content types. This setting ensures that those headers are sent with the requests, allowing the scanner to communicate with the application in the same way a legitimate user or service would.

In addition, adding custom request headers can help differentiate scanner traffic from real user traffic in your logs. For example, you might add a unique header like `X-Scanner-User: ZeroThreat` to clearly identify requests made by the scanner. This helps in monitoring and troubleshooting by making it easier to distinguish between genuine user activity and automated scans.

<figure><img src="https://1825008717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fs6Y7hKb1RwZWFZo4EnUm%2Fuploads%2FVYb9ab63Clyj7UtwU5kl%2Fimage.png?alt=media&#x26;token=ce847336-b0da-4a60-8bb5-dd0ec660298d" alt=""><figcaption></figcaption></figure>

Adding the correct request headers can be important because in some scenarios failing to do so may cause the scanner to be blocked or treated as a bot, leading to incomplete or invalid scan results.

## **Ignore URIs**

This setting allows you to exclude specific URIs from the scan.

**Ignore URIs** allows you to specify certain parts of your application that should be ignored by the scanner. This is useful when there are areas of your application that you don’t want to be scanned, such as pages that are not relevant to security testing, or areas that are out of scope for your current scan.

For example, you might want to exclude certain administrative pages, user-specific dashboards, or testing environments.

<figure><img src="https://1825008717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fs6Y7hKb1RwZWFZo4EnUm%2Fuploads%2FIuyBVAbCELuk7yk3tcXg%2Fimage.png?alt=media&#x26;token=a5f9b3a8-3077-48b4-9743-0bef78d8659c" alt=""><figcaption></figcaption></figure>

Ignoring non-critical or irrelevant URLs helps speed up the scan and avoids unnecessary scans of low-value endpoints. It also protects sensitive areas from being scanned unnecessarily.&#x20;

{% hint style="warning" %}
<mark style="color:orange;">**Be Careful When Using Ignore URIs**</mark>

Make sure to only exclude URLs that are genuinely irrelevant to your scan. Overusing this setting can lead to critical vulnerabilities being missed if important paths are inadvertently ignored.
{% endhint %}

***

Configured your target? Now head over to [publish-your-docs](../getting-started/publish-your-docs "mention")to start your scan.
