Fix configuration check problems

Before beginning a security assessment, XBOW runs a configuration check to validate that your environment is ready for testing. This preflight phase reduces the risk of incomplete or inaccurate results.

Tip: When a check fails, read the card under the failed check on the “Configuration check” page. It explains the problem and the fix.

For details about the configuration check process, see Checking configurations before assessment.

Target is unreachable

If XBOW cannot reach your target:

  1. Verify the target URL is correct on the “Target configuration” page and that the target is accessible at that URL.
  2. Confirm that you have configured firewall access for XBOW. See Configure your server to allow XBOW requests.
  3. Verify the target is running and responding to requests.
  4. Ensure DNS is resolving correctly.

Target returned an error

If XBOW connected to the target but the response was an error:

  • A 403 usually means a firewall or access rule is rejecting XBOW requests. See Configure your server to allow XBOW requests.
  • A 5xx that persists after you retry the checks points to a problem on the target server. Check the server’s logs and test the URL manually.

Authentication is unsuccessful

If XBOW cannot authenticate:

  1. Read the failure reason.
  2. Click Show logs to open the trace view of the agent’s actions and screenshots leading up to the failure. This often points to the problem.
  3. Verify credentials are correct by testing them manually.
  4. If your site uses multi-factor authentication, verify that MFA is correctly configured for XBOW. See Define authentication for testing.
  5. If your site uses CAPTCHA, ensure that it is disabled for the test account.
  6. Verify the account is not locked or disabled.
  7. If you provided authentication instructions on the “Target configuration” page, check that they are correct.

Concurrent sessions blocked

After authenticating successfully with the target, XBOW checks whether the server supports multiple concurrent sessions for the test account. If the test fails, you are prompted to enable sequential testing.

Click Enable sequential mode in the error message box.

Note: Assessments take longer when only one session can be used at a time, but this is required by some servers.

Limited scope discovery

If XBOW discovers limited scope:

  1. Verify the test account has sufficient permissions to access all areas of the target you intend to test.
  2. Check that the target is fully functional.
  3. Review authentication flow to ensure it completes successfully.
  4. Manually navigate the target with the test account to verify it can access all intended functionality. If components are missing, check account permissions and target configuration.

If scope discovery remains limited after following these steps, see Review domain scope.

WAF detection found

If the configuration check shows a “WAF blocking detected” warning, XBOW’s probes triggered a web application firewall (WAF) on the target server. Configure the server to allow XBOW’s traffic before you start.

Allow XBOW through your WAF using a custom bypass header or IP allowlisting. See Configure firewall access.

The same fixes apply if the card under the target check reports that a WAF blocked XBOW’s first request.

For the trade-offs between each access option, see Protecting assets during XBOW testing.

Retry checks

When you have fixed any problems reported on the “Configuration check” page, click Retry checks to validate the fixes.

Next step

Was this helpful?