You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: cloud/scanning/internal-scan.mdx
+65-78Lines changed: 65 additions & 78 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,132 +8,119 @@ Internal network security is critical yet often overlooked. Once attackers gain
8
8
ProjectDiscovery offers two distinct approaches for internal network vulnerability scanning, each designed to fit different organizational needs while maintaining our core focus on exploitability and accurate detection.
Run Nuclei locally and upload results to PDCP. Ideal for teams with existing scanning workflows or specific network restrictions.
15
+
Run Nuclei locally and upload results to PD's platform. Ideal for teams with existing scanning workflows or specific network restrictions.
16
16
</Card>
17
17
</CardGroup>
18
18
19
19
<Note>
20
20
Internal scanning helps identify misconfigurations, unpatched systems, and security gaps that could be exploited for lateral movement before attackers can leverage them.
21
21
</Note>
22
22
23
-
## Port Discovery with Naabu
23
+
## Method 1: Agent based Scanning (Recommended)
24
24
25
-
Before running vulnerability scans, it's recommended to first identify open ports in your internal network using [Naabu](https://github.com/projectdiscovery/naabu) - a fast and reliable port scanner. This ensures comprehensive vulnerability scanning coverage.
25
+
To use this feature you'll need to install and deploy pd-agent within your internal network. The agent acts as a bridge between your internal infrastructure and ProjectDiscovery's platform, enabling you to trigger and manage scans remotely.
pd-agent is a lightweight agent that you deploy within your internal network to execute scans and enumerations remotely. It establishes a secure connection between your internal infrastructure and ProjectDiscovery's platform, receives scan configurations and executes them locally using ProjectDiscovery's tools.
The discovered ports can be used as input for vulnerability scanning to ensure thorough coverage of all exposed services. Learn more about Naabu's capabilities in our [detailed documentation](/opensource/naabu/overview).
40
-
</Note>
41
-
42
-
<Info>
43
-
Naabu will soon be integrated directly into ProjectDiscovery's internal vulnerability scanning capabilities. Contact our [sales team](https://projectdiscovery.io/request-demo) to be notified when this feature becomes available.
44
-
</Info>
45
-
46
-
## Method 1: Cloud-Managed Scanning (Recommended)
47
-
48
-
[TunnelX](https://github.com/projectdiscovery/tunnelx) is our open-source tunneling solution, purpose-built by ProjectDiscovery to enable secure internal scanning. It establishes isolated SOCKS5 proxies that let you trigger scans directly from the ProjectDiscovery interface while ensuring your internal infrastructure remains protected and unexposed.
33
+
-**Network Discovery**: Automatically discover assets, services, and open ports across your internal network
34
+
-**Vulnerability Scanning**: Execute Nuclei-based vulnerability scans using templates from the ProjectDiscovery's platform
35
+
-**Agent Tagging**: Organize agents with tags and networks for targeted execution
36
+
-**Passive Discovery**: Optional passive network discovery via libpcap/gopacket
37
+
-**Automatic Updates**: Receive and execute new scan configurations automatically
49
38
50
39
<Note>
51
-
Cloud-managed internal scanning with TunnelX is an Enterprise-exclusive feature. Free users can still perform internal scans using the local scanning method described above.
40
+
Agent based internal scanning is an Enterprise-exclusive feature. Free users can still perform internal scans using the local scanning method described below.
52
41
</Note>
53
42
54
43
<Note>
55
44
**System Requirements**\
56
-
TunnelX is designed to be lightweight and efficient. Minimum recommended specifications for optimal performance:
45
+
The agent is designed to be lightweight and efficient. Minimum recommended specifications for optimal performance:
57
46
58
-
-**CPU:**1 vCPU/Core
59
-
-**Memory:**2GB RAM
47
+
-**CPU:**2 vCPU
48
+
-**Memory:**4GB RAM
60
49
-**Network:** 100Mbps network interface
61
50
-**Storage:** 10GB available disk space
62
51
-**Operating System:** Linux (recommended), macOS, or Windows
63
52
64
-
These specifications are suitable for most deployment scenarios. A basic VPS (Virtual Private Server) meeting these requirements is sufficient for running TunnelX efficiently.
53
+
These specifications are suitable for most deployment scenarios. A basic VPS (Virtual Private Server) meeting these requirements is sufficient for running pd-agent efficiently.
65
54
</Note>
66
55
67
-
### Install TunnelX
56
+
### Step 1: Create a Network
68
57
69
-
Choose your preferred installation method:
58
+
Before installing the agent, you need to create a network in the ProjectDiscovery's platform. Each network represents a distinct internal environment (e.g., production, staging, office network) and generates a unique agent configuration.
70
59
71
-
<CodeGroup>
60
+
1. Navigate to [https://cloud.projectdiscovery.io/networks](https://cloud.projectdiscovery.io/networks)
61
+
2. Click **"Create Network"**
62
+
3. Provide a network name
63
+
4. Save the network to generate your unique agent installation command
72
64
73
-
```bash Docker (Recommended)
74
-
# Pull and run the official image
75
-
docker run --network host -d \
76
-
-e PDCP_API_KEY="your_api_key" \
77
-
projectdiscovery/tunnelx:latest
65
+
<Frame>
66
+
<imgsrc="/images/pdcp-create-network-demo.gif"alt="Creating a Network in PDCP" />
docker run --network host -d -e PDCP_API_KEY="your_api_key" tunnelx
82
-
```
69
+
<Info>
70
+
You can create multiple networks for different environments or network segments. Each network can have one or more agents deployed.
71
+
</Info>
83
72
73
+
### Step 2: Install the agent
84
74
85
-
```bash Go Installation
86
-
# Install using go install
87
-
go install github.com/projectdiscovery/tunnelx@latest
75
+
After creating your network, the platform will display a unique installation command pre-configured with your credentials and network settings. Simply copy and run this command in your internal environment where you want the agent deployed.
88
76
89
-
# Set your API key and run
90
-
export PDCP_API_KEY="your_api_key"
91
-
tunnelx
92
-
```
77
+
<Warning>
78
+
Keep your installation command secure - it contains your API key and agent configuration. Anyone with this command can connect an agent to your network.
79
+
</Warning>
93
80
81
+
The installation command will:
82
+
- Download and configure the agent
83
+
- Establish a secure connection to ProjectDiscovery's platform
The agent must remain running to execute scans. For production deployments, consider running it as a system service (systemd, Docker, or Kubernetes) to ensure it stays active.
94
+
</Note>
102
95
103
-
</CodeGroup>
96
+
### Step 3: Trigger Internal Scans
104
97
105
-
### Triggering Internal Scans
98
+
Once your pd-agent is connected, triggering internal scans works identically to external scanning. The workflow is seamless - you configure scans through the same interface and view results in the same dashboard.
106
99
107
-
Once you've successfully configured TunnelX, you can easily trigger internal scans directly from the ProjectDiscovery Cloud Platform:
100
+
1.**Initiate a Scan**:
101
+
- Click on the **Scan** button for the network you want to scan
102
+
- Or go to the **Scans** menu (https://cloud.projectdiscovery.io/scans) and click on **Create New Scan**, choose **Internal** followed by the network you want to scan. Similar to how you would run an external scan
108
103
109
-
1.**Navigate to Scans Dashboard**:
110
-
- Go to https://cloud.projectdiscovery.io/scans
111
-
- Click the "Create new scan" button
112
104
2.**Configure Your Scan**:
113
-
- Set your targets, templates, and other scan configurations
114
-
- Proceed to the final "Scan settings" step
115
-
3.**Enable Internal Scanning**:
116
-
- In the bottom left corner of the Scan settings screen, you'll see an "Internal Scan" option
117
-
- Select this option to use your connected TunnelX proxy
118
-
- Choose the appropriate internal proxy connection from the dropdown
119
-
120
-
<img
121
-
width="800"
122
-
src="/images/tunnelx-scan-time.png"
123
-
alt="Internal Scan Option in Scan Settings"
124
-
/>
105
+
-**Targets**: Enter internal IPs, hostnames, or CIDR ranges (e.g., `192.168.1.0/24`, `internal-server.local`)
-**Configuration**: Choose scan settings, rate limits, headers, and other parameters
125
108
126
-
4.**Launch Your Scan**:
127
-
- Click "Create scan" to start scanning your internal targets
109
+
3.**Launch Your Scan**:
110
+
- Click **"Create Scan"** to start scanning your internal targets
111
+
- The scan executes through pd-agent in your internal network
112
+
- Results appear in your dashboard just like external scans
128
113
129
-
Your scan will now execute against internal targets through the secure TunnelX connection, with results appearing in your ProjectDiscovery dashboard just like external scans.
114
+
<Frame>
115
+
<imgsrc="/images/pdcp-internal-scan-demo.gif"alt="Creating and Running an Internal Scan in PDCP" />
116
+
</Frame>
130
117
131
118
<Note>
132
-
TunnelX connections appear automatically in the dropdown once properly configured. If you don't see your connection, check that TunnelX is running properly and your API key is correctly configured.
119
+
Internal scanning provides the same experience as external scanning - identical template selection, scan configuration, results viewing, retesting capabilities, and integration options.
133
120
</Note>
134
121
135
122
<Note>
136
-
**Important:** Only input targets that are actually accessible from the machine where TunnelX is running. For example, if TunnelX is deployed on a server in your internal network (192.168.1.0/24), it can only scan hosts within that network or other networks it has routing access to. If you input external targets or internal hosts that the TunnelX machine cannot reach, the scan will fail.
123
+
**Important:** Only input targets that are accessible from where pd-agent is deployed. If the agent is running on a server in your 192.168.1.0/24 network, it can only scan hosts within that network or other networks it has routing access to.
0 commit comments