Blacklisting domains in mobile scans

This guide walks through excluding domains from mobile scans by configuring the scan scope.

Mobile scans use Scope URLs regexes to define which domains or URLs are considered in scope. To blacklist or exclude a domain, provide a regular expression that matches the URLs you want to keep in scope and does not match the domain you want to exclude.

Go to report.ostorlab.co

1. Introduction

By excluding domains, you can avoid testing out-of-scope targets during a mobile scan.

Introduction

2. Click here

Initiate the process by clicking the "New Scan" icon.

New Scan Icon

3. Select the asset type

Choose the mobile asset type. This can be Play Store, App Store, Android APK, Android AAB, iOS IPA, or iOS TestFlight.

Select the asset type

4. Provide the target

Provide the scan target.

Provide the target

5. Click "Continue"

Progress to the next step by clicking continue.

Click 'Continue'

6. Click "Full Scan"

Select the Full Scan option.

Click 'Full Scan'

7. Click "Continue"

Confirm your choice to proceed by clicking continue.

Click 'Continue'

8. Select Test Credentials

Select the test credentials to use. This step is optional.

Select Test Credentials

9. Click "Continue"

Click continue to proceed to the Advanced Settings step.

Click 'Continue'

10. Provide the domain exclusion regex

In Scope URLs regexes, enter a regular expression that excludes the domain from the scan scope.

For example, to exclude example.com and its subdomains, add the following regex:

^https?://(?!(?:[^/?#:]+\.)?example\.com(?::\d+)?(?:[/?#]|$)).*

This keeps example.com, www.example.com, api.example.com, and other example.com subdomains out of scope for the scan.

Provide the domain exclusion regex

Regex examples

Exclude example.com and all its subdomains:

^https?://(?!(?:[^/?#:]+\.)?example\.com(?::\d+)?(?:[/?#]|$)).*

Exclude only the root domain example.com, while allowing subdomains:

^https?://(?!example\.com(?::\d+)?(?:[/?#]|$)).*

Exclude only one subdomain, such as staging.example.com:

^https?://(?!staging\.example\.com(?::\d+)?(?:[/?#]|$)).*

Exclude multiple domains, such as example.com and test.example.org:

^https?://(?!(?:(?:[^/?#:]+\.)?example\.com|(?:[^/?#:]+\.)?test\.example\.org)(?::\d+)?(?:[/?#]|$)).*

Allow only trusted production domains, which is often simpler than using blacklist-style regexes:

^https?://api\.example\.com(?::\d+)?(?:[/?#]|$).*
^https?://auth\.example\.com(?::\d+)?(?:[/?#]|$).*

When adding multiple lines, each line is treated as a scope regex. Direct allowlist examples can be entered one per line. Blacklist-style exclusions should be written as a single regex that excludes the domain from the matched scope.