Launching network scans

Note

Currently, this functionality:

• is experimental;
• is available only to super administrators when the organization has permission to scan networks;
• is not available through the web interface.

Before launching a scan, it is recommended to perform the steps described in the Preparing to scan production applications.

A network scan can be launched in the following ways:

• Launching via the API — a launch involving the backend. Permissions are required to launch. It is bound to a target.
• Launching via the fuchsiactl console client — a launch without the backend. Such a scan has no target binding.

Launching via the API

The API web interface is available in Swagger.

The following requests are performed with the boolean parameter network-scan: true specified.

1. Use the POST /api/targets request to create a network target.

2. Use the POST /api/scans request with the addresses parameter to launch a scan of a network target group.

   Example request body:

   {
     "addresses": ["192.168.31.65", "192.168.31.134/32", "example.com", "api.example.com", "admin.example.com"]
   }
   

   Alternatively, the raw parameter can be used to launch a network scan. In this case, the scan target information is specified directly in the request.

   Example request body:

   {
     "raw": [
       {
         "type": "network",
         "request": {
           "targets": ["127.0.0.1/32"],
           "modules": ["network-scan-module"]
         }
       }
     ]
   }
   

3. The GET /api/scans/{id} request can be used to retrieve information about the specified network scan. The main distinguishing feature of such a scan is the presence of the addresses fields.

Launching via the fuchsiactl console client

1. Use the fuchsiactl network_scan command with the desired parameters (for more details on the available commands, see the help).
2. To retrieve information about a network scan, use the fuchsiactl network_scan_logs --scan <scan_id> command.