Skip to main content

How to Add Assets to Collections in SpartanX

Walk through adding URLs, IPs, APIs, web apps, and mobile binaries to a collection. Includes DNS validation and format checks before assets are confirmed.

Written by SpartanX CS

A collection only becomes useful once assets are associated with it. SpartanX supports a broad range of asset types — from URLs and IP addresses to mobile app binaries — and the process of adding them is fast, with built-in validation to catch errors before an engagement runs.


Navigating to Assets

From the left-hand navigation, click the Assets tab. At the top of the asset view, select the collection you want to add assets to from the dropdown. If a collection has no assets yet, it will show zeros across all asset type counts.
​


Adding Assets

Click "Add Assets" and select your target collection. Enter the asset you want to add — this can be a domain, IP address, API endpoint, or URL. After entering the address, click "Validate."

Validation only needs to happen once per asset. The platform checks:

  • DNS resolution — confirms the address resolves correctly

  • Format validity — catches typos such as double dots or invalid top-level domains

  • Top-level domain legitimacy — ensures the domain structure is valid

You can add multiple assets at once. In real environments, it's common to add dozens or even hundreds of assets to a collection in a single session.
​


How SpartanX Classifies Assets

SpartanX automatically classifies assets based on how you enter them. For example:

  • A full domain URL (e.g., https://example.com) is classified as a web application, which includes API coverage

  • A path-specific URL (e.g., /graphql) is classified as an API endpoint only

This distinction matters for engagement scope — a web application classification will include both web and API testing, while an API-only classification focuses the engagement narrowly.
​


Mobile App Assets

For mobile applications, add the binary file rather than a URL:

  • iOS apps: drag and drop the IPA file

  • Android apps: drag and drop the APK file

Once uploaded, the mobile binary becomes an asset in the collection and can be included in static analysis (SAST) and dynamic analysis (DAST) engagements.
​


What's Next

With assets added and a collection ready, you're set to run an engagement. The next section provides an overview of all engagement types available in SpartanX — from full-scope red team operations to targeted attack validation and remediation verification.

Did this answer your question?