Overview This document describes how to extend an Invicti On-Premises installation with custom vulnerability checks. Even though a default installation of Invicti already includes thousands of carefully crafted vulnerability checks, users with specific requirements and customized environments may benefit from extending scan coverage and functionality…
How to Use Allowed Hosts
When you build web applications, you often use multiple back-end web services to interface between client-side and server-side applications. For example, enterprises use functional subdomains to distribute static content or application logic between API requests. To scan the entire web application, the web vulnerability scanner…
How many users can I configure in Invicti?
The number of users that you can configure in Invicti depends on the edition that you have purchased. Invicti Standard does not allows for only one user – the same user that is created when installing Invicti. Invicti Premium (both on-premises and online) allows for…
How to Use Excluded Hours
Invicti provides additional functionality for managing your scans. You may encounter a situation, where scans should not interfere with scheduled deployments or hinder the web application functionality during certain times. With that in mind, it is possible to configure excluded hours for Invicti during which…
How to Configure Invicti with Kenna Security
You can integrate Invicti with Kenna Security as a connector, out of the box. The following configuration applies to both the Kenna VM appliance and the SaaS solution. First, create a new Kenna instance. On the Home page, you can see statistics for imported vulnerability…
Authenticated Scans on Applications That Make Use of One-time Tokens or CAPTCHAs
One-Time Tokens add another layer of security, supplementing the username and password with a code that only the individual user has access to (for example by SMS or via a security key). A CAPTCHA has a different purpose, as it provides a test used to…
Scanning applications that make use of Single Sign-On (SSO)
Single Sign-On (SSO) is a service which allows users to have one set of login credentials to access multiple web applications. SSO allows a user to log in once and gain access to various applications, without the need to re-enter login credentials at each application….
Session Detection: What to do if the LSR fails to identify a session pattern
Session Detection is the final step in the configuration of the Login Sequence Recorder (LSR). A valid Session Pattern is vital for a successful scan, as with it the scanner is able to identify whether it is authenticated or not. During a scan, the session…
Which Linux distributions can Invicti be installed on?
Invicti has been tested on the following Linux distributions: Ubuntu Desktop/Server 16.0.4 LTS or higher Suse Linux Enterprise Server 15 and openSUSE Leap 15.0 Invicti may work on other Linux distributions. For example, we have a number of Invicti users who installed Invicti on Kali…
