Infrastructure Checks

Scan hosts, networks, domains and container images from the Infrastructure page (Infrastructure Checks in the sidebar). Select Scan Type chooses what the scan does; each type takes its own options. For a new user the page opens on Vulnerability Scan with only Autonomous AI assessment (the AI Pentest agent) switched on; after that it opens with the scan type, scanners, Ping hosts and Scan ports you last submitted.

Before you start

Target formats, separators and the refused-target messages are the same as for web scans: see Web App Scanning, Targets. Starting a scan needs the Operator or Team admin role.

Run an infrastructure scan

1. 01
   Open the form

   Select Infrastructure Checks in the sidebar. The page title reads Infrastructure Scan.

2. 02
   Choose the scan type

   Select Scan Type under Infrastructure Engine Settings: Vulnerability Scan, Network Discovery, Local Patching Checks, Domains OSINT or Docker Image Scan.

3. 03
   Choose the product and enter the targets

   Product / Eng ID, then IPs, hosts or domains under Target Scope. Fetch targets (the cloud button) reuses the targets this product was last scanned with.

4. 04
   Set the options of the type

   For a Vulnerability Scan: the scanners, Ping hosts and Scan ports. See the sections below.

5. 05
   Select Start Analysis

   Scan submitted appears and the scan's page opens; if the scan is waiting in the queue, Scan History opens instead.

Check that it worked: the scan's page shows Queued or Started and the log fills. If the scan does not start, see the messages under Web App Scanning (If the scan does not start); they are the same here, with No valid targets provided for targets that are not accepted.

The form

To scan hosts you already have, tick them on the Assets page (up to 50, of one product) and choose Scan: this form opens with them as the targets.

Vulnerability Scan

Identifies open ports, running services and related vulnerabilities across the specified IP addresses or host names. Choose the scanners under Choose scanners:.

Ping hosts and Scan ports apply to Nessus, OpenVAS, the discovery pre-scan, Nuclei and Bruteforcer, and to Network Discovery. Local Patching Checks always use the SSH and SMB ports; the other scan types ignore both options.

zoom_inEnlarge

Network Discovery

Discovers live hosts and open ports, and the service and version that answers on each port. It has no scanner switches; it uses Ping hosts and Scan ports. What it finds at an address is saved to every host with that address in Assets; hosts deleted there with Ignore these hosts in future scans are skipped.

zoom_inEnlarge

Local Patching Checks

Checks for missing operating-system patches over SSH (TCP 22) for Linux and SMB/WMI (TCP 445, 139) for Windows. Hosts with these ports open are checked by both scanners below. It has no scanner switches.

Domains OSINT

Works from a domain name rather than a host list, so it finds the exposure you did not know to put in scope. Enter domains such as example.com, another.org. It discovers:

• Subdomains (switch on Bruteforce hostnames under OSINT Options to also guess subdomain names; off by default)
• Active hosts
• Leaked email addresses
• Compromised credentials, with a Dehashed API key
• Host service and vulnerability data, with a Shodan API key

Subdomains, email addresses and Shodan data are in the Report; subdomains are also saved to Assets. Compromised credentials found through Dehashed appear in Credentials. Without the Shodan and Dehashed keys the scan still runs and returns less.

Docker Image Scan

Scans a container image for known vulnerabilities in its packages with Trivy. Enter the full image path in the targets field, for example:

public.ecr.aws/portswigger/dastardly:latest

The image is downloaded and analysed. The team's allowed infrastructure targets are checked against the registry the image comes from, not the image name: allow public.ecr.aws for the example above, or docker.io for Docker Hub images such as nginx:1.25.

When a scan is incomplete

An OpenVAS or Nessus that is not set up is skipped with a Scanner skipped warning in the log instead of failing the scan. A scan type whose scanner images this server lacks is marked Not installed on this server. on the form. All outcomes are listed in Managing scan execution. AI Pentest is the only AI scan of infrastructure.

From a pipeline or a terminal

# Vulnerability scan of two hosts, Top 1000 ports, including hosts that do not answer ping
scansuite-ci --scan-type infra --scanners openvas,nuclei \
  --target 10.0.4.10,10.0.4.11 --ports "Top 1000 TCP/UDP" --no-ping

Infrastructure scans need --scanners: hosts_scan (Network Discovery), hosts_patching, osint and docker_image_scan run on their own; openvas, nessus, nuclei, nuclei_custom, hosts_bruter and ai_pentest are the Vulnerability Scan choices. Unlike the form, the client pings hosts unless you pass --no-ping. See CI/CD and automation.

Where results go

• AI Pentest, Nessus and Custom Rules always record their findings on the Vulnerabilities page (Nessus at or above the team's Lowest severity to store).
• OpenVAS, Nuclei and Docker Image Scan record theirs there too, at Medium severity and above, while the team's Store scanner findings is On (the default; Teams, Scanning tab, Scanner findings in Vulnerabilities card).
• Everything is in the scan's Report in Scan History and, when the team has DefectDojo connected, in DefectDojo (see Set up DefectDojo).