Get a demo
AppSec with Zero Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Support
Scan Agents

Installing scan agents on Linux (Debian Distribution)

This document is for:
Invicti Enterprise On-Demand, Invicti Enterprise On-Premises

To scan websites in a demilitarized zone (DMZ) or internal networks that are not publicly accessible, install an Invicti scan agent on your network. The agent performs the scan and reports the results to Invicti Enterprise.

Optionally, you can install an authentication verifier agent to verify form authentication on your website.

You can install the scan agent on a Linux operating system. For Debian distributions, ensure the required dependencies are met.

This document focuses on installing a scan agent on Debian-based systems. For Red Hat distributions, refer to Installing a Scan Agent on Linux (Red Hat Distribution).

This process involves three steps:

  1. Download the Invicti Enterprise agent
  2. Install the Invicti agent 
  3. Set the agent as a Linux service

Prerequisites

Hardware Requirements

  • Processor: 1.4 GHz minimum (2.0 GHz or faster recommended)
  • Memory: 4 GB or higher recommended
  • Storage: 10 GB free disk space per internal agent
  • If NTLM is used as the authentication method, Ubuntu version 24.04 or its equivalent must be used at a minimum.

Network Requirements

  • The agent must access your internal website via HTTP/HTTPS
  • The agent must connect to the Invicti Enterprise Authentication Verifier Server over HTTP(S) (port 443)

Allowlisting Requirements

  • Domains:
  • Regional IPs - Allowlist the following addresses according to your region:
  • US: 54.85.169.114, 3.232.155.177, netsparkercloud.com, s3.us-east-1.amazonaws.com
  • EU: 3.122.90.89, 3.71.172.17, eu.netsparker.cloud, s3.eu-central-1.amazonaws.com
  • CA: 15.223.111.146, 3.99.19.87, 3.96.72.255, ca.netsparker.cloud, s3.ca-central-1.amazonaws.com

Required Access

  • Users must have root privileges to execute the required commands. If root privileges are unavailable, use the Docker-based scan agent instead. For instructions, refer to Installing a Docker Scan Agent.

Step 1: Download the Agent

To install the scan agent, download the installation files to a machine on your internal network. These are the steps to download a Scan Agent in Invicti Enterprise On-Demand:

  1. In Invicti Enterprise, select Agents > Manage Agents from the left-side menu.
  2. Click Configure New Agent.

  1. From the Agent - Direct Download section, select Linux to download the required files to install the verifier agent.

Step 2: Install the Agent

To install the Invicti Agent follow these instructions:

  1. Open a terminal window.
  2. Update the operating system's application repositories:

sudo apt update && sudo apt upgrade -y

  1. Install the required dependent packages:

sudo apt-get install p7zip-full  

sudo apt install -y wget gss-ntlmssp nano mono-complete apt-transport-https

  1. Create a folder for the Agent dependency:

sudo mkdir -p /home/[YOUR_USER]/.local/share/Netsparker_Ltd

  1. Change the ownership of the folder:

sudo chown -R [YOUR_USER] /home/[ YOUR_USER]/.local/share

NOTE:  Make sure that [YOUR_USER] in this step matches the [YOUR_USER] in the unit file described later in this guide.

  1. To install the necessary dependencies for Headless Chrome, run the following command:

sudo apt install -y gconf-service libasound2 libatk1.0-0 libatk-bridge2.0-0 libc6 libcairo2 libcups2 libdbus-1-3 libexpat1 libfontconfig1 libgcc1 libgconf-2-4 libgdk-pixbuf2.0-0 libglib2.0-0 libgtk-3-0 libnspr4 libpango-1.0-0 libpangocairo-1.0-0 libstdc++6 libx11-6 libx11-xcb1 libxcb1 libxcomposite1 libxcursor1 libxdamage1 libxext6 libxfixes3 libxi6 libxrandr2 libxrender1 libxss1 libxtst6 ca-certificates fonts-liberation libappindicator1 libnss3 lsb-release xdg-utils libgdiplus 

IMPORTANT:

If the operating system is Ubuntu 24.04 or higher, the following must be used:

sudo apt install -y libasound2t64 libatk1.0-0 libatk-bridge2.0-0 libc6 libcairo2 libcups2 libdbus-1-3 libexpat1 libfontconfig1 libgcc1 libgdk-pixbuf2.0-0 libglib2.0-0 libgtk-3-0 libnspr4 libpango-1.0-0 libpangocairo-1.0-0 libstdc++6 libx11-6 libx11-xcb1 libxcb1 libxcomposite1 libxcursor1 libxdamage1 libxext6 libxfixes3 libxi6 libxrandr2 libxrender1 libxss1 libxtst6 ca-certificates fonts-liberation libnss3 lsb-release xdg-utils libgdiplus

After installing the dependencies, you can download and configure the Headless Chrome browser.

WARNING FOR KALI DISTRIBUTIONS
You may encounter an issue while installing the libappindicator1 dependency specified in step 6 above. If this happens, refer to the section Adding Debian Repository to the Sources.List in Kali Rolling below for instructions on how to resolve it.

  1. Extract the Agent TAR file by running the following commands:

cd /home/[YOUR_USER]

sudo tar -xvf Invicti_Enterprise_Scanner_Agent.tar --one-top-level

sudo chown -R [YOUR_USER]:[YOUR_USER] /home/[YOUR_USER]/Invicti_Enterprise_Scanner_Agent

  1. Open the appsettings.json file using your preferred text editor to enter the required information (e.g., ApiToken):

cd /home/[YOUR_USER]/Invicti_Enterprise_Scanner_Agent

nano appsettings.json

Changing the default data folder for the scanner Agent

To change the default data folder, add the following attribute under AgentInfo in the appsettings.json file:

"ScanDataFolderPath": "FullPath"

For example, you can set the path like this:

/home/[YOUR_USER]/[data folder]/

  • If you modify an existing agent's appsettings.json file, you must restart the service after making the change.
  • If you are adding this line to a new agent, you can continue with the installation process as usual.

These settings will be used by the agent:

  • AgentName: You can set this to any name you prefer. It will be displayed when starting a new scan. If installing multiple instances of the agent, ensure each has a unique AgentName that you will reference later.
  • AgentType: This can be set to either Standard or Cloud. If you plan to use a Cloud Provider for scanning, set AgentType to Cloud.
  • ApiToken: The ApiToken corresponds to the Agent Token displayed in the Configure New Agent window of Netsparker Enterprise. Copy this value into the ApiToken field.
  • ApiRootUrl: The URL of Invicti Enterprise or the Invicti Enterprise On-Premises.

Adding Debian Repository to the Source.List in Kali Rolling Distribution

To install libappindicator1 for Headless Chrome browser dependencies, add the Debian Repository to the sources.list in Kali Rolling using these instructions:

  1. Open a terminal and run this command.

sudo nano /etc/apt/sources.list

  1. Add the following lines to the sources.list file:

deb http://deb.debian.org/debian buster main contrib non-free  

deb-src http://deb.debian.org/debian buster main contrib non-free

  1. Save and close the file.
  2. Update the repositories:

sudo apt update

  1. Install libappindicator1:

sudo apt install libappindicator1

  1. After installing libappindicator1, you can resume the agent installation starting from step 2 point 8 above.

INFORMATION

To enable detection of Out-of-Band (OOB) vulnerabilities using Invicti Hawk, ensure the following ports are allowlisted on your agent server:

  • TCP Ports: 80 and 443
  • UDP Port: 53

For more details about Invicti Hawk and its vulnerability detection capabilities, refer to How Invicti Hawk Finds Vulnerabilities.

Step 3: Set the Agent as a Linux service

An internal agent must be set up as a Linux service to regularly poll the Invicti Enterprise servers and receive scan initiation commands.

You can complete this configuration in three steps:

  1. Add a unit file for an Invicti Agent
  2. Configure Sudoers for an Invicti Agent
  3. Start Invicti Enterprise Agent as a Linux Service

3.1 Add a unit file for an Invicti Agent

Follow these steps to add a unit file fon the Invicti Agent:

  1. Open a terminal
  2. cd /etc/systemd/system
  3. sudo touch [YOUR_AGENT_NAME].service
  4. sudo nano [YOUR_AGENT_NAME].service

IMPORTANT:

The AgentName specified in the appsettings.json file must match the unit file name of the agent. Consistency between these names is required for proper operation.

  1. Add the following script into [YOUR_AGENT_NAME].service:

# For internal agents version 2.0.2.157 and newer:

[Unit]

Description=netsparker.service description

[Service]

Type=notify

KillMode=process

Restart=always

RestartSec=30

SyslogIdentifier=[YOUR_USER]

KillSignal=SIGINT

User=[YOUR_USER]

WorkingDirectory= [YOUR_AGENT_DIRECTORY_PATH]

ExecStart = ./[Your Agent Directory path]/Netsparker.Cloud.Agent

ExecStop=/usr/bin/pkill -f "[YOUR_AGENT_DIRECTORY_PATH]/Nhs/NetsparkerHelperService.exe"

[Install]

WantedBy=multi-user.target

  1. Save and close the document.

3.2 Configure Sudoers for an Invicti Agent

To configure Sudoers for the Invicti agent, follow these steps:

  1. Navigate to the sudoers directory:

sudo cd /etc/sudoers.d

  1. Create a new sudoers file:

sudo touch [YOUR_AGENT_NAME]-systemctl

  1. Edit the file with visudo:

sudo visudo -f [YOUR_AGENT_NAME]-systemctl

  1. Add the following script to grant the necessary permissions:

[YOUR_USER] ALL=(ALL:ALL) NOPASSWD: /usr/bin/systemctl start [YOUR_AGENT_NAME].service  

[YOUR_USER] ALL=(ALL:ALL) NOPASSWD: /usr/bin/systemctl stop [YOUR_AGENT_NAME].service

  1. Save and close the file.

3.3 Start Invicti Enterprise Agent as a Linux Service

  1. Reload the system daemon to recognize the new service:

sudo systemctl daemon-reload

  1. Start the agent service:

sudo systemctl start [YOUR_AGENT_NAME].service

TIP:

To ensure the scanning agent service remains active after a machine reboot:

  1. Open a terminal.
  2. Enable the agent service to start automatically:

    sudo systemctl enable [YOUR_AGENT_NAME].service

  1. You can now verify the connection between Invicti Enterprise and the scan agent by navigating to the Agents menu and selecting Manage Agents.

Installing multiple Agents on the same operating system

You can install multiple agents on a Linux system by following these steps:

  1. Open a Terminal Window:
    Launch the terminal on your Linux operating system.
  2. Create a Folder for the New Agent:
    Create a separate directory to house the files for the new agent. For example:

mkdir /path/to/new-agent

cd /path/to/new-agent

  1. Copy and Extract the TAR File:
    Move the TAR file for the agent to the newly created folder and extract it:

tar -xvf /path/to/agent.tar.gz

  1. Install and Configure the Agent:
    Follow the instructions provided in Installing the Agent and Setting Agent as a Linux Service to complete the installation.
  2. Set a Unique Name for the New Agent:
    Ensure the new agent is assigned a unique name during configuration to avoid conflicts with existing agents.

For more details about managing agents, refer to Managing Groups.

Top Articles

What is Invicti?

Overview of Scan Policies

Scheduling Scans

Managing Integrations

Built-In Reports