> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vigolium.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Native Scan Phases

> Run Vigolium's native scan phases independently, skip specific phases, or chain them into a custom pipeline.

## Overview

Vigolium's native scan pipeline consists of multiple phases that run sequentially. You can run the full pipeline, isolate a single phase with `--only`, or skip specific phases with `--skip`. This guide walks through each phase and how to run them independently.

## The Full Pipeline

When you run a standard scan, phases execute in this order:

1. **External Harvest**: gather endpoints from external sources (Wayback Machine, CommonCrawl, AlienVault, urlscan, VirusTotal)
2. **Discovery**: content discovery via wordlists and fuzzing
3. **Spidering**: browser-based crawling to discover dynamic content
4. **Known Issue Scan**: template-based scanning with Nuclei + Kingfisher secret detection
5. **Dynamic-Assessment**: active and passive vulnerability scanning modules

A full scan with all phases enabled:

```bash theme={null}
vigolium scan -t https://example.com --discover --spider --external-harvest --known-issue-scan
```

> Source-aware whitebox analysis (SAST, code audit, route extraction) lives in agent mode now, see [Agentic Scanning](/guides/agentic-scan).

## Running a Single Phase

Use `vigolium run <phase>` or `vigolium scan --only <phase>` to execute one phase in isolation.

### Probe

A host sweep: one request per target, passive fingerprinting and attack-surface scoring, no content discovery and no fuzzing. Built for host lists in the thousands, where `run discovery` would spend its whole budget on the first handful.

```bash theme={null}
vigolium run probe -T hosts.txt -c 20
```

Sweep with JSONL on stdout and TLS certificates:

```bash theme={null}
vigolium run probe -T hosts.txt --json --no-response --tls-probe
```

The aliases `probing`, `httpx`, `alive`, and `sweep` all work. A probe-only run flips its own defaults - redirect hops recorded, `--redirect-mode same-apex`, proactive WAF pacing off - see [Probe](/native-scan/phases/probe) for the full flag surface and the `surface_score` model.

### Discovery

Discovers new endpoints through wordlist-based fuzzing and content probing:

```bash theme={null}
vigolium run discovery -t https://example.com
```

Equivalent to:

```bash theme={null}
vigolium scan -t https://example.com --only discovery
```

Tune discovery with additional flags:

```bash theme={null}
vigolium run discovery -t https://example.com \
  --discover-max-time 30m \
  -c 100 \
  --rate-limit 200
```

### Spidering

Crawls the target using a headless browser to discover pages, forms, and JavaScript-rendered content:

```bash theme={null}
vigolium run spidering -t https://example.com
```

Control the browser engine and parallelism:

```bash theme={null}
vigolium run spidering -t https://example.com \
  -E chromium \
  -b 3 \
  --spider-max-time 20m \
  --no-forms
```

The alias `spitolas` also works:

```bash theme={null}
vigolium run spitolas -t https://example.com
```

### External Harvest

Pulls endpoints from external intelligence sources (Wayback Machine, certificate transparency logs):

```bash theme={null}
vigolium run external-harvest -t https://example.com
```

### Known Issue Scan

Runs template-based scanning (Nuclei templates) against ingested endpoints:

```bash theme={null}
vigolium run known-issue-scan -t https://example.com
```

Filter templates by severity or tags:

```bash theme={null}
vigolium run known-issue-scan -t https://example.com \
  --known-issue-scan-severities critical,high \
  --known-issue-scan-tags cve,rce
```

### Dynamic-Assessment

Runs active and passive vulnerability scanning modules. This is the core scanning phase (formerly named `audit`).

```bash theme={null}
vigolium run dynamic-assessment -t https://example.com
# alias also works:
vigolium run audit -t https://example.com
```

Select specific modules or tags:

```bash theme={null}
vigolium run dynamic-assessment -t https://example.com -m xss -m sqli
vigolium run dynamic-assessment -t https://example.com --module-tag injection
```

### Extension

Runs only custom JavaScript or YAML extensions:

```bash theme={null}
vigolium run extension -t https://example.com --ext ./my-checks.js
```

## Skipping Phases

Use `--skip` to disable specific phases while keeping the rest of the pipeline:

```bash theme={null}
# Run everything except spidering
vigolium scan -t https://example.com --discover --skip spidering

# Skip both spidering and known-issue-scan
vigolium scan -t https://example.com --discover --skip spidering --skip known-issue-scan
```

Note: `--only` and `--skip` cannot be used together.

## Phase Aliases

Every phase accepts shorthand aliases - the gerund, the internal engine name, and the vocabulary of the tool it replaces. Canonical names are listed first.

| Canonical Phase      | Aliases                                              |
| -------------------- | ---------------------------------------------------- |
| `ingestion`          | `ingest`, `ingesting`                                |
| `probe`              | `probing`, `httpx`, `alive`, `sweep`                 |
| `discovery`          | `discover`, `discovering`, `deparos`                 |
| `external-harvest`   | `harvest`, `harvesting`, `external-harvester`        |
| `spidering`          | `spider`, `spitolas`, `crawl`, `crawling`, `crawler` |
| `known-issue-scan`   | `cve`, `kis`, `known-issue`, `known-issues`          |
| `dynamic-assessment` | `dast`, `audit`, `assessment`, `assess`              |
| `extension`          | `ext`, `extensions`                                  |

Run `vigolium strategy --json` for the authoritative list - it is generated from the same registry the flags are validated against, so `phases[].canonical` and `phases[].aliases` are exactly what `--only`, `--skip`, and `run <phase>` accept.

## Chaining Phases Manually

You can chain independent phase runs to build a custom pipeline. Each phase stores its results in the database, so subsequent phases pick up where the previous one left off:

```bash theme={null}
# Step 1: Discover endpoints
vigolium run discovery -t https://example.com

# Step 2: Dynamic-assessment over the discovered endpoints
vigolium run dynamic-assessment -t https://example.com

# Step 3: Run custom extensions against results
vigolium run extension -t https://example.com --ext ./custom-check.js
```

## Tuning Per-Phase Performance

Override concurrency and rate limits for individual phases using the config file (`vigolium-configs.yaml`):

```yaml theme={null}
scanning_pace:
  concurrency: 25
  rate_limit: 100

  discovery:
    concurrency: 100
    duration_factor: 1.0

  spidering:
    max_duration: 20m

  dynamic-assessment:
    parallel_passive: true
```

CLI flags (`-c`, `--rate-limit`) always take precedence over config values.

## Controlling Scope

Scope filtering applies across all phases. Use `--scope-origin` to control host matching:

```bash theme={null}
# Strict: exact host match only
vigolium run discovery -t https://api.example.com --scope-origin strict

# Balanced: same eTLD+1 (*.example.com)
vigolium run discovery -t https://api.example.com --scope-origin balanced

# Relaxed (default): host contains target keyword
vigolium run discovery -t https://api.example.com --scope-origin relaxed
```

## Adding Authentication

All phases respect authentication headers. Pass them with `-H`:

```bash theme={null}
vigolium run dynamic-assessment -t https://api.example.com \
  -H 'Authorization: Bearer eyJhbGciOi...' \
  -H 'Cookie: session=abc123'
```

For multi-session testing (e.g., IDOR detection), use session configs:

```bash theme={null}
vigolium run dynamic-assessment -t https://api.example.com \
  --auth-file sessions.yaml
```