Infrastructure Checks
Vulnerability scans, network discovery, patching checks, OSINT and container images.
Select the scan type from the Select Scan Type dropdown on the Infrastructure page. Each type takes a different set of options.
Vulnerability Scan
Identifies open ports, running services and related vulnerabilities across the specified IPs or hostnames.
| Scanner | Notes |
|---|---|
| OpenVAS | Popular open-source vulnerability scanner. Must be installed separately. |
| Nessus | Commercial vulnerability scanner. Also requires separate installation. |
| Nuclei | Fast template-based checks. Included by default with a standard installation. |
| Custom Rules | Executes the rules created in the Custom Rules menu. |
| Bruteforcer | Enumerates known network services (FTP, SSH, SMB and others) and attempts bruteforce using credentials from the Credentials tab plus popular username/password pairs. |
| AI Pentest | Supersedes the others and runs an autonomous engagement instead. |
Options
- Define scan targets and frequency, and optionally schedule the scan.
- Choose whether to ping hosts before scanning ports. Recommended for internal scans, where it saves a great deal of time on large subnets.
- Pick a scan ports preset — All TCP, Top 1000 TCP/UDP, All TCP/UDP, PCI External Scan — or supply your own list with the Custom option.
- Enable the discovery pre-scan to find live hosts before vulnerability scanning.
Network Discovery
Discovers live hosts and open ports. Supports the same ping pre-check and port presets. Discovered hosts are saved to Assets.
Local Patching Checks
Checks for missing OS patches over SSH (TCP 22) for Linux and SMB/WMI (TCP 445, 139) for Windows.
| Target formats | Hostnames, IP addresses, subnets and ranges. |
| Ubuntu | 16.04 to 24.04 |
| Red Hat | 7 to 9 |
| Debian | 9 to 12 |
| OpenVAS | Authenticates with username/password or username/SSH key pair. Results upload to DefectDojo automatically. |
| Vuls | Supports only username/SSH key pair. Results are not uploaded to DefectDojo; an XLSX file per host is available from the Report button. |
Patching checks are credentialed scans. Provide the relevant credentials through the Settings menu first, or every host will simply fail to authenticate.
Domains OSINT
Reconnaissance on the specified domains, discovering:
- Subdomains
- Active hosts
- Leaked email addresses
- Compromised credentials — requires a Dehashed API key
- Host service and vulnerability data — requires a Shodan API key
Input is a comma or newline separated list of domains, for example example.com, another.org.
Subdomains and associated data are available from the Report button; discovered email addresses and credentials appear in Credentials.
Without the Shodan and Dehashed keys configured in Settings, the scan still runs — it simply returns less. Those two stages are silently reduced rather than failing the scan.
Docker Image Scan
Scans a Docker image for known vulnerabilities in its local packages. Provide the full path to the image in the registry:
public.ecr.aws/portswigger/dastardly:latestThe image is downloaded and analysed by the scanner.
Docker registry authentication is not currently supported. Only public images can be scanned remotely — a private image must be pre-loaded on the ScanSuite worker node.
Last reviewed 2026-08-16