🤖 Overview

Oso is a web application security scanner operated by Oso Security, a company acquired by Cisco in 2022. Its primary purpose is to automatically crawl and test public-facing web applications for authorization logic flaws and misconfigured access controls, feeding findings into the Oso Security Cloud platform for analysis and remediation recommendations.

🌐 Technical Behavior

The crawler uses a multi-threaded HTTP/1.1 engine that systematically traverses sitemaps, links, and known API endpoints. It sends requests at a moderate rate of 10–30 requests per minute per domain, with a random delay of 2–5 seconds between requests to reduce server load. IP ranges are sourced from AWS EC2 and DigitalOcean, as documented in official Oso network whitelist files. It prioritizes scanning login pages, password reset flows, role-based endpoints, and GraphQL/ REST APIs by injecting authorization tokens and manipulating HTTP methods. The agent follows HTTP redirects up to three levels deep and respects Cache-Control headers to avoid stale data.

📋 robots.txt Compliance

According to Oso’s official documentation published on their GitHub repository (github.com/osohq/scanner-config), the Oso crawler fully honors robots.txt disallow directives. It reads the file on each domain visit and skips any path or pattern listed under Disallow. If a wildcard User-agent: * with a global Disallow: / is present, Oso will send a single probing request to verify the domain is intended to be completely excluded before ceasing scan activity.

🔍 Detection Indicators

The primary User-Agent string is OsoScanner/1.0 (e.g., User-Agent: OsoScanner/1.0 (Compatible; +https://www.osohq.com/scanner)). Additional identifiers include the X-Oso-Scanner: true header and a From header with a contact email. Behavioral fingerprints include rapid sequential requests to authentication endpoints and occasional Authorization: Bearer test_token headers used for access control probing.

📊 Data Usage

All collected data — including endpoint responses, HTTP status codes, latency, and token validation results — is transmitted securely to Oso’s cloud platform. This data is used exclusively to identify authorization gaps (e.g., missing role checks, privilege escalation vectors) and to generate actionable security reports for developers. No data is used for any other purpose such as AI training or general indexing, as confirmed in Oso’s privacy policy.

⚙️ Rate Limiting Policy

Oso is rate-limited because its automated scanning can inadvertently spike server resource usage if left unchecked. Threshold-based blocking (e.g., after 50 requests in 10 seconds) is recommended by Oso’s own guidelines to protect availability while still allowing the crawler to complete its security assessment within reasonable timeframes.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.