Documentation
Scans
How to create and run different types of scans and how to optimize scan settings, profiles, and scopes.
- Introduction to Scanning
-
Launching Scans
- Running informal PCI DSS Compliance Scans
- Running official PCI DSS Scans and PCI DSS Group Scans
- Defining PCI DSS scan policy in Invicti Standard
- Scanning single-tab targets with Invicti Standard
- Creating a New Scan
- Scheduling Scans in Invicti Enterprise
- Best practices for creating effective scan schedules in Invicti Enterprise
- Scheduling Scans in Invicti Standard
- Setting up incremental scans
- Retrieving Mend SAST and SCA scan results
- Scan Results
-
Working with Scans
- Post-request scripts
- Suspending, pausing, and resuming scans
- Manual Crawling in Proxy Mode
- Excluding Parts of a Website From a Scan
- Excluding and Including Links from the Sitemap After Crawling
- Configuring Additional Websites
- Scanning Applications in an IP Range
- Configuring URL Rewrite Rules
- Scan Groups in Invicti Enterprise
-
Pre-Request Scripts
- Writing a Pre-Request Script
- Testing Pre-Request Scripts
- Scanning with pre-request scripts in Invicti Enterprise On-Demand
- Saving Pre-Request Scripts into the Invicti Directory
- Writing Pre-Request Scripts
- Use Cases and Presets
- Debugging Pre-Request Scripts Using Helper Functions
- Verifying Pre-Request Scripts
- Using the business logic recorder
-
Importing and Exporting Scan Sessions in Invicti Standard
- How to Import a Scan Session into Invicti Standard from Invicti Enterprise
- How to Import a Scan Session to Invicti Standard from Your Local Machine
- How to Export the Current Scan Session from Invicti Standard to Your Local Machine
- How to Export the Current Scan Session from Invicti Standard to Invicti Enterprise
- How to Bulk Export Selected Scans from Invicti Standard to Invicti Enterprise
- Scan Time Window
- Performance Analysis in Invicti
- Checking scan coverage and addressing gaps
- Factors leading to longer scan times
- Reducing scan times
- Scan Search in Invicti Standard
- Adding a custom header to your scans in Invicti Enterprise
- Adding a custom header to your scans in Invicti Standard
- Queued scan failure settings
- Scan Profiles
-
Security Checks
- Security Checks
- WAF Identifier
- GraphQL Library Detection
- Identifying MongoDB injection vulnerabilities
- BREACH Attack
- Forced Browsing
- Login Page Identifier
- Malware Analyzer
- Custom Scripts for Security Checks in Invicti Enterprise
- Custom Scripts for Security Checks in Invicti Standard
- Custom Security Checks via Scripting
- Identifying sensitive data
-
How Invicti reports vulnerabilities
- Apache Struts RCE
- Code Evaluation
- Command Injection (CI)
- Cross Site Scripting (XSS)
- File Inclusion
- Header Injection
- NoSQL Injection
- Server-Side Request Forgery (SSRF)
- SQL Injection
- Static Resources
- XML External Entity (XXE)
- Arbitrary Files (IAST)
- BREACH Attack
- Configuration Analyzer (IAST)
- Content Security Policy
- Content-Type Sniffing
- Cookie
- Cross Frame Options Security
- Cross-Origin Resource Sharing (CORS)
- Cross-Site Request Forgery
- Drupal Remote Code Execution
- Expression Language Injection
- File Upload
- GraphQL Library Detection
- Header Analyzer
- Heartbleed
- HSTS
- HTML Content
- HTTP Methods
- HTTP Status
- HTTP.sys (CVE-2015-1635)
- IFrame Security
- Insecure JSONP Endpoint
- Insecure Reflected Content
- JavaScript Libraries
- JSON Web Token
- Login Page Identifier
- Malware Analyzer
- Mixed Content
- Open Redirection
- Oracle WebLogic Remote Code Execution
- Referrer Policy
- Reflected File Download
- Signatures
- Software Composition Analysis (SCA)
- SSL
- Unicode Transformation (Best-Fit Mapping)
- WAF Identifier
- Web App Fingerprint
- Web Cache Deception
- WebDAV
- Windows Short Filename
- HTTP Request Builder
- Command Line Interface
-
Authentication
- Authentication – Overview
- Form Authentication – Configure and verify
- Form authentication with OTP – Configuration
- Form authentication – Introduction of custom scripts
- Form authentication – Custom script basics and examples
- Form authentication – Create custom scripts
- Form authentication – Custom script editor fields
- Form authentication – Troubleshooting, tips, and tricks
- Authentication profiles
- Configuring Basic, Digest, NTLM/Kerberos and Negotiate Authentication
- Configuring Client Certificate Authentication
- Configuring OAuth2 Authentication
- Configuring Header Authentication
- Logout detection – Introduction and tips
- Logout detection – Configuration
- Logout detection – Issues
- Invicti Standard – Form authentication – Configuration
- Invicti Standard – Form authentication – Verification
- Invicti Standard – Manual Authentication
- Invicti Standard – Smart Card authentication – Configuration
- Invicti Standard – HMAC Authentication via Scripting
- Invicti Standard – Interactive Logins
- Invicti Standard – Form Authentication API
- Invicti Standard – Form authentication – Create and verify custom scripts
- Invicti Standard – Logout detection – Configuration
- Invicti Standard – Logout detection – Issues
- Working with Scan Scopes