Configuring Invicti Enterprise for Amazon Web Services

This document is for:

Invicti Enterprise On-Premises

Invicti Enterprise can be configured to run scanner agents on Amazon Web Services (AWS). When you launch a new scan, Invicti Enterprise will create a new instance for the target scan and terminate it automatically once the scan is completed.

For further information Cloud Provider Settings.

This topic explains how to configure Invicti Enterprise to run scanner agents on AWS (Windows OS). To see the Linux version, see Configuring Invicti Enterprise for Linux on Amazon Web Services (Ubuntu).

Starting from the Invicti Enterprise On-Premises 2.3, our brand has been changed from Netsparker to Invicti. With this change, the installation path has also been updated. So, if you have any agents from the previous version, you need to remove them and re-install your agents by following this document.

AWS Configuration

First, you need to install and configure the scanner agent on an EC2 instance and then create a machine image (AMI) to use it as a base instance.

Each stage of this process is outlined below:

Selecting a Region
Creating S3 Buckets
Creating IAM Users
Creating an AMI for the Scanner Agent
Configuring Invicti Enterprise

Selecting a region

Invicti Enterprise uses AWS S3 buckets for object storage and EC2 service for launching new instances.

S3 and EC2 resources need to be in the same AWS region. For that reason, please choose an AWS region and create all resources in that region.

How to select a region

For information on how to select a region, see Amazon’s EMR documentation, Choose an AWS Region.

Creating S3 Buckets

Invicti Enterprise needs three different buckets to store scan data.

How to create S3 Buckets

Open the AWS console and navigate to the S3 service.
Create 3 buckets for raw scan data, screenshots and customizations. For example, you can use bucket names like this:
- exampleinc.ne.scandata (for raw scan data)
- exampleinc.ne.scanscreenshots (for form authentication screenshots)
- exampleinc.ne.customizations (for customizations)

Recommended practices for S3 Buckets

You can apply the following precautions to harden your bucket.

Enable Encryption: Amazon provides a default encryption service or you can use your own keys. For further information, Amazon S3 default encryption for S3 buckets.
Monitoring and Auditing: Amazon provides ways to monitor and audit S3 buckets. For further information, Amazon S3 Monitoring and Auditing Best Practices.

Creating IAM Users

Next, you must create IAM Users.

How to create an access policy for the web application

Go to AWS console and navigate to the IAM service.
Select Policies.
Select Create Your Own Policy.
Enter a policy name (e.g. NEWebAppPolicy).
Enter your bucket names in the policy template code below and paste it into the Policy Document field.

{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:*"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::ENTER_SCAN_DATA_BUCKET_NAME/*",
"arn:aws:s3:::ENTER_SCREENSHOTS_BUCKET_NAME/*",
"arn:aws:s3:::ENTER_CUSTOMIZATIONS_BUCKET_NAME/*"
]
},
{
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags",
"ec2:DescribeInstances",
 "ec2:RunInstances",
"ec2:TerminateInstances"
],
"Effect": "Allow",
"Resource": [
"*"
]
}
]
}

Select Create Policy.

How to create an access policy for the scanner agent

Select Policies.
Select Create Your Own Policy.
Enter a policy name for scanner agent (e.g. NEAgentPolicy).
Enter your bucket names into the policy template code below, and paste it into the Policy Document field.

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Action": [
 "s3:DeleteObject",
 "s3:PutObject"
 ],
 "Effect": "Allow",
 "Resource": [
 "arn:aws:s3:::ENTER_SCAN_DATA_BUCKET_NAME/*",
 "arn:aws:s3:::ENTER_SCREENSHOTS_BUCKET_NAME/*"
 ]
 },
 {
 "Action": [
 "s3:ListBucket"
 ],
 "Effect": "Allow",
 "Resource": [
 "arn:aws:s3:::ENTER_CUSTOMIZATIONS_BUCKET_NAME",
 "arn:aws:s3:::ENTER_SCAN_DATA_BUCKET_NAME",
 "arn:aws:s3:::ENTER_SCREENSHOTS_BUCKET_NAME/*"
 ]
 },
 {
 "Action": [
 "s3:GetObject"
 ],
 "Effect": "Allow",
 "Resource": [
 "arn:aws:s3:::ENTER_CUSTOMIZATIONS_BUCKET_NAME/*",
 "arn:aws:s3:::ENTER_SCAN_DATA_BUCKET_NAME/*",
 "arn:aws:s3:::ENTER_SCREENSHOTS_BUCKET_NAME/*"
 ]
 }
 ]
}

Select Create Policy.

How to create a user for the web application

Select Users.
Select Add User.

Enter a user name (e.g. NEWebApp).
In the Access Type field, enable Programmatic access, and select Next.

Select Attach existing policies directly.
Choose the previously created web app policy (e.g. NEWebAppPolicy).
Select Next to create the web app user.
Save the access and security key (you will need it later).

How to create a user for scanner agent

Select Users.
Select Add User.
Enter a user name (e.g. NEAgent).
Choose Programmatic access for Access Type and select Next.

Select Attach existing policies directly.

Choose the previously created scanner agent policy (e.g. NEAgentPolicy).
Select Next to create the scanner agent user.
Save access and security key to use them later.

Creating an AMI for the scanner agent

There are three steps to this process:

Launching an instance for the scanner agent
Configuring the scanner agent instance
Creating a scanner agent image

Launching an instance for the scanner agent

First, you need to launch an instance for a Scanner Agent.

How to launch an instance for a scanner agent

Navigate to the EC2 service.
From the main menu, select Instances.
Select Launch Instance.
Choose Microsoft Windows Server 2019 Base as the AMI.

Select Choose Instance Type and select an Instance Type (c4.large is recommended).

Select Configure Instance.
Set the Auto-assign Public IP drop-down to Enable. (This is needed for RDP connections.)

Selectt Next: Add Storage and set the Disk Size (a minimum of 30 GB is recommended).
Select Next: Add Tags.
Select Next: Configure Security Group.
Select Review and Launch.

Configuring the scanner agent instance

Next, you need to install the Invicti Scanner Agent to the target EC2 instance.

How to configure a scanner agent instance

Navigate to the EC2 service.
From the main menu, select Instances.
Right-click the previously launched scanner agent instance and select Connect.

Connect to your instance with the supplied RDP information.
Ensure that you can connect to your on-premises Invicti Enterprise web application from this instance.
Download and extract InvictiEnterprise.zip AgentSetup.exe into your instance
Run AgentSetup.exe and install the scanner agent. Enter the required information asked by the agent installation wizard. For API Token, navigate to the Configure New Agent page by selecting Agents > Manage Agents > Configure New Agent.

8. Start a command prompt and type:

cd C:\Program Files (x86)\Invicti Enterprise Agent

By default, the scanner agent is not configured to run in AWS. Enter this command to uninstall the scanner agent’s Windows service:

Netsparker.Cloud.Agent.exe /u

Open the agent’s configuration file with a text editor: C:\Program Files (x86)\Invicti Enterprise Agent \appsettings.json.
Navigate to the AgentInfo section and set agentType to Cloud.

  "AgentInfo": {
    "AgentName": "Agent-1",
    "AgentType": "Cloud",
    "ApiRootUrl": "http://localhost:80",
    "ApiToken": ""
  },

Save the appsettings.json file.
Type this command to re-install scanner agent windows service:

Netsparker.Cloud.Agent.exe /i

The installed agent’s Windows Service’s Startup Type will be ‘Manual’ (it must stay that way).
Open a PowerShell command window and run the following command:

C:\ProgramData\Amazon\EC2-Windows\Launch\Scripts\InitializeInstance.ps1 –Schedule

Creating a scanner agent image

Next, you need to create an AMI that will be used as a base image for new scans.

How to create a scanner agent image

Open the EC2 instances page on the AWS console.
Select the EC2 instance and from the Actions menu, select Instance State > Stop/ Wait for the agent instance to be stopped.
Once the agent instance has stopped, right click on it, and select Create Image. Enter a name for your image and select Create Image.

Navigate to the AMIs page and save your AMI ID (you will need it later).