Support
Getting Started

Configuring Invicti Enterprise for Linux on Amazon Web Services (Ubuntu)

This document is for:
Invicti Enterprise On-Premises

Invicti Enterprise can be configured to run scanner agents on Amazon Web Services (AWS). When you launch a new scan, Invicti Enterprise creates a new Linux instance for the target scan and terminates it automatically once the scan is completed.

For further information, see Cloud Provider Settings.

This article explains how to configure Invicti Enterprise for Linux on AWS to run scanner agents.

AWS configuration

First, you need to install and configure the scanner agent on an EC2 instance and then create a machine image (AMI) to use it as a base instance.

There are five stages for this:

  1. Selecting a Region
  2. Creating S3 Buckets
  3. Creating IAM Users
  4. Creating an AMI for the Scanner Agent
  5. Configuring Invicti Enterprise

Step 1. Selecting a region

Invicti Enterprise uses AWS S3 buckets for object storage and EC2 service for launching new instances.

S3 and EC2 resources need to be in the same AWS region. For that reason, please choose an AWS region and create all resources in that region.

How to select a region

For information on how to select a region, see Amazon’s EMR documentation, Choose an AWS Region.

Step 2. Creating S3 Buckets

Invicti Enterprise needs three different buckets to store scan data. 

How to create S3 Buckets
  1. Open the AWS console and navigate to the S3 service.
  2. Create 3 buckets for raw scan data, screenshots, and customizations. For example, you can use bucket names like this:
    • exampleinc.ne.scandata (for raw scan data)
    • exampleinc.ne.scanscreenshots (for form authentication screenshots)
    • exampleinc.ne.customizations (for customizations)

Recommended practice for S3 Buckets

You can apply the following precautions to harden your bucket.

  1. Enable Encryption: Amazon provides a default encryption service or you can use your own keys. For further information, Amazon S3 default encryption for S3 buckets.
  2. Monitoring and Auditing: Amazon provides ways to monitor and audit S3 buckets. For further information, Amazon S3 Monitoring and Auditing Best Practices.

Step 3. Creating IAM Users

Next, you must create IAM Users.

How to create an access policy for the web application
  1. Go to the AWS console and navigate to the IAM service.
  2. Select Policies.
  3. Select Create Your Own Policy.
  4. Enter a policy name (e.g. NEWebAppPolicy).
  5. Enter your bucket names in the following policy template code and paste the code into the Policy Document field.
  6. Select Create Policy.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:*"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::ENTER_SCAN_DATA_BUCKET_NAME/*",
"arn:aws:s3:::ENTER_SCREENSHOTS_BUCKET_NAME/*",
"arn:aws:s3:::ENTER_CUSTOMIZATIONS_BUCKET_NAME/*"
]
},
{
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags",
"ec2:DescribeInstances",
"ec2:RunInstances",
"ec2:TerminateInstances"
],
"Effect": "Allow",
"Resource": [
"*"
]
}
]
}
How to create an access policy for the scanner agent
  1. Select Policies.
  2. Select Create Your Own Policy.
  3. Enter a policy name for scanner agent (e.g. NEAgentPolicy).
  4. Enter your bucket names into the following policy template code and paste the code into the Policy Document field.
  5. Select Create Policy.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:DeleteObject",
"s3:PutObject"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::ENTER_SCAN_DATA_BUCKET_NAME/*",
"arn:aws:s3:::ENTER_SCREENSHOTS_BUCKET_NAME/*"
]
},
{
"Action": [
"s3:ListBucket"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::ENTER_CUSTOMIZATIONS_BUCKET_NAME",
"arn:aws:s3:::ENTER_SCAN_DATA_BUCKET_NAME",
"arn:aws:s3:::ENTER_SCREENSHOTS_BUCKET_NAME/*"
]
},
{
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::ENTER_CUSTOMIZATIONS_BUCKET_NAME/*",
"arn:aws:s3:::ENTER_SCAN_DATA_BUCKET_NAME/*",
"arn:aws:s3:::ENTER_SCREENSHOTS_BUCKET_NAME/*"
]
}
]
}
How to create a user for the web application
  1. Select Users.
  2. Select Add User.
  3. Enter a user name (e.g. NEWebApp).
  4. In the Access Type field, enable Programmatic access, and select Next.
  5. Select Attach existing policies directly.
  6. Select the previously created web app policy (e.g. NEWebAppPolicy).
  7. Select Next to create the web app user.
  8. Save the access and security key (you will need it later).
How to create a user for the scanner agent
  1. Select Users.
  2. Select Add User.
  3. Enter a user name (e.g. NEAgent).
  4. Choose Programmatic access for Access Type and select Next.
  5. Select Attach existing policies directly.
  6. Choose the previously created scanner agent policy (e.g. NEAgentPolicy).
  7. Select Next to create the scanner agent user.
  8. Save the access and security key (you will need it later).

Step 4. Creating an AMI for the Scanner Agent

There are three steps to this process:

  1. Launching an Instance for the Scanner Agent
  2. Configuring the Scanner Agent Instance
  3. Creating a Scanner Agent Image

Launching an Instance for the Scanner Agent

First, you need to launch an instance for a Scanner Agent.

How to launch an instance for a scanner agent
  1. Navigate to the EC2 service.
  2. From the main menu, select Instances.
  3. Select Launch Instance.
  4. Choose Ubuntu instance base as the AMI.
  5. Select Choose Instance Type and choose an Instance Type (c4.large is recommended).
  6. Select Configure Instance.
  7. Set the Auto-assign Public IP drop-down to Enable. (This is needed for RDP connections.)
  8. Select Next: Add Storage and set the Disk Size (a minimum of 30 GB is  recommended).
  9. Select Next: Add Tags.
  10. Select Next: Configure Security Group.
  11. Select Review and Launch.

Configuring the Scanner Agent Instance

You need to install the Invicti Scanner Agent to the target EC2 instance. There are two steps to install the agent on your Ubuntu instance.

  1. Configuring scanner agent instance
  2. Setting agent as a Linux service
How to configure a scanner agent instance
  1. Navigate to the EC2 service.
  2. From the main menu, select Instances.
  3. Right-click the previously launched scanner agent instance, and select Connect.
  4. Connect to your instance with the supplied RDP information.
  5. Ensure that you can connect to your on-premises Invicti Enterprise web application from this instance.
  6. Update the following operating system application repositories:
sudo apt update && sudo apt upgrade -y
  1. Install the following dependent packages:
sudo apt-get install p7zip-full
sudo apt install -y wget gss-ntlmssp nano mono-complete apt-transport-https

Please make sure that your Mono version is 5.20 or above. For further information, please see How to update Mono.

  1. Create a folder for Netsparker Scanner dependency:
sudo mkdir -p /home/ubuntu/.local/share/Netsparker_Ltd 
sudo chown -R ubuntu /home/ubuntu/.local/share/Netsparker_Ltd
  1. Install the Headless Chrome browser dependencies:
sudo apt install -y gconf-service libasound2 libatk1.0-0 libatk-bridge2.0-0 libc6 libcairo2 libcups2 libdbus-1-3 libexpat1 libfontconfig1 libgcc1 libgconf-2-4 libgdk-pixbuf2.0-0 libglib2.0-0 libgtk-3-0 libnspr4 libpango-1.0-0 libpangocairo-1.0-0 libstdc++6 libx11-6 libx11-xcb1 libxcb1 libxcomposite1 libxcursor1 libxdamage1 libxext6 libxfixes3 libxi6 libxrandr2 libxrender1 libxss1 libxtst6 ca-certificates fonts-liberation libappindicator1 libnss3 lsb-release xdg-utils libgdiplus
  1. Next, extract the TAR file:
    1. Download Invicti_Enterprise_Scanner_Agent.tar onto your Linux instance
    2. To extract the scan agent, run the following commands: tar xf Invicti_Enterprise_Scanner_Agent.tar chmod +x .local-chromium/Linux-*/chrome-linux/chrome

You must change the agent folder name to invicti-agent after extracting the Invicti_Enterprise_Scanner_Agent.tar

Open appsettings.json file to enter the necessary information, such as ApiToken: sudo nano appsettings.json

You need to configure the AgentInfo section of the appsetting.json file in the following way:

  • AgentName: This must be invicti-agent
  • AgentType: Navigate to the AgentInfo section and set agentType to Cloud.
  • ApiToken: In the Invicti Enterprise On-Premises, the Agent Token is displayed on the Configure New Agent page. Copy the value into the apiToken.
  • ApiRootUrl: This is the URL of the Invicti Enterprise On-Premises.
How to update Mono

You need to update Mono so that Netsparker Helper Service can work properly. You can update the Mono as specified below:

For Ubuntu 18.04:

  1. sudo apt install gnupg ca-certificates
  2. sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 3FA7E0328081BFF6A14DA29AA6A19B38D3D831EF
  3. echo "deb https://download.mono-project.com/repo/ubuntu stable-bionic/snapshots/5.20 main" | sudo tee /etc/apt/sources.list.d/mono-official-stable.list
  4. sudo apt update
    • The AgentName in the appsetting.json file, the unit file name for the agent, and the agent folder name must be the same. This is required to start the scan agent as a Linux service.
  5. sudo apt install mono-runtime

Setting Agent as a Linux Service

A cloud agent should be configured as a Linux service so that it can poll the Invicti Enterprise servers regularly and can take the scan initiation command from the server. 

You can complete this process in three steps:

Add a Unit File for an Invicti Agent

  1. Open a terminal.
  2. cd /etc/systemd/system
  3. sudo touch invicti-agent.service
  4. sudo nano invicti-agent.service
  5. Add the following script into invicti-agent.service:
Description=netsparker.service description
[Service]
Type=notify
KillMode=process
Restart=always
RestartSec=30
SyslogIdentifier= ubuntu
KillSignal=SIGINT
User=[YOUR_USER]
WorkingDirectory= [YOUR_AGENT_DIRECTORY_PATH]
ExecStart= /home/ubuntu/Netsparker.Cloud.Agent
ExecStop=/usr/bin/pkill -f /home/ubuntu/Nhs/NetsparkerHelperService.exe
[Install]
WantedBy=multi-user.target

Save and close the document.

Creating a Scanner Agent Image

Next, you need to create an AMI that will be used as a base image for new scans.

How to create a scanner agent image
  1. Open the EC2 instances page on the AWS console.
  2. Select the EC2 instance and from the Actions menu click Instance State > Stop/ Wait for the agent instance to be stopped.
  3. Once the agent instance has stopped, right-click on it, and click Create Image. Enter a name for your image and click Create Image.
  4. Navigate to the AMIs page and save your AMI ID (you will need it later).

Step 5. Configuring Invicti Enterprise

Next, you need to configure your AWS settings.

How to configure the Invicti Enterprise Web Application
  1. Make an RDP connection to your Invicti Enterprise web application server.
  2. Log in to Invicti Enterprise.
  3. From the main menu, select Settings > Cloud Provider.
  4. Enter your AWS settings.
    • You can find the settings for the Instance Type, Subnet ID, and Key Pair Name in your stopped instance’s details in AWS.
    • Select Security Group to get the Security Group id (e.g. sg-abc3fec2).
  5. You can now run new scans on your AWS environment.

Updating the Scanner Agent

Next, you need to update the scanner agent.

How to update the scanner agent
  1. In the AWS EC2 console, open the AMI page. Right-click on your current scanner agent’s AMI and launch an instance.
  2. Once your scanner agent instance is ready, make an RDP connection to it.
  3. Download the Invicti Enterprise installation bundle. After downloading and extracting the invicti-agent-release-onpremises-2.3.0.0.tar file, configure your scanner agent instance as described in How to configure a scanner agent instance.
  4. Next, log in to Invicti Enterprise.
  5. From the main menu, select Settings > Cloud Provider Settings.
  6. Enter your new AMI and select Save.

Invicti Help Center

Our Support team is ready to provide you with technical help.

Go to Help Center This will redirect you to the ticketing system.