Installing and Configuring Acunetix 360 On-Premises

Acunetix 360 is also available as an On-Demand and On-Premises solution. The On-Premises is identical to the hosted version in terms of features and capabilities, but since it runs on your own servers and network, there are a few things to note:

  • You can scan any internal web application without the need to allow incoming access through corporate firewalls.
  • No internet connection is required.
  • Acunetix 360 On-Premises can also be easily deployed on Amazon Web Services (AWS), Microsoft Azure, Google Cloud, or any other type of private cloud environment.
  • If your business has to adhere to strict regulatory compliance requirements and policies or you have concerns with your data being stored on our servers, you can still take advantage of Acunetix 360's workflow tools, and scaling and scanning capabilities. That is because the On-Premises edition can be installed on your own servers that are managed by your own team.
  • No data will leave the On-Premises edition of Acunetix 360.

This topic explains how to install Acunetix 360 Enterprise On-Premises.

Information

All Acunetix editions support IPv6 both as servers and agents. This means you can configure Acunetix 360 On-Premises server to use IPv6, and Acunetix 360 can scan websites that use IPv6.

Acunetix 360 has five parts:

Acunetix 360 Application Server

This provides the web interface that enables the efficient administration and automation of scans.

This is the application that users will see and use via the Acunetix 360 UI.

Acunetix 360 Agent

This is a service application that executes scans and informs the Acunetix 360 Application Server of the results.

A single agent can only run one scan at a time. If you want to run more than one scan at a time, you will need to install more agents.  

Acunetix 360 Authentication Verifier Agent

This is a service application that verifies form-based login authentication configuration.

This is an optional component. If you are scanning websites that require form authentication, you need to install it.

Acunetix 360 Authentication Verifier Service

This is a service application that establishes communication between the Authentication Verifier Agent and the Acunetix 360 Application Server.

This is an optional component. If you are scanning websites that require form authentication, you need to install it.

Acunetix 360 Bridge

This is a service application that is used to relay information from the Shark agent to the scanning agent.

This is an optional component. If you are using Acusensor for Java, .NET, and Node.js, you need to install this bridge.

Prerequisites

This section lists the minimum requirements for installing Acunetix 360 On-Premises.

Minimum Requirements for Acunetix 360 Application Server

All components (the Application Server, the Agent, the Authentication Verifier Agent, the Authentication Verifier Service, the Acusensor Bridge, and Database Server) can be installed on the same server if the hardware meets the listed requirements.

Information

We highly recommend that you install the Agents on separate servers to maximize stability and performance.

Software Requirements

  • Windows Server 2016 or above (Windows Server 2019 recommended)
  • Web Server (IIS) role should be installed on the server
  • IIS 10
  • .NET Framework 4.8

Hardware Requirements

  • 1.4 GHz Processor (2 GHz or faster recommended)
  • 4 GB RAM (8 GB or higher recommended)
  • 5 GB Free Disk space (20 GB or higher recommended)

Required Access for Installation

  • RDP credentials and access as a user with Administrator rights
  • Can be installed by an Acunetix Engineer (or the user) using the provided installer

Minimum Requirements for Acunetix 360 Agent

These are the minimum requirements for Acunetix 360 Agent.

Software Requirements

  • Windows Server 2016 or above (Windows Server 2019 recommended)
  • .NET Framework 4.8

Hardware Requirements

  • 1.4 GHz Processor (2 GHz or faster recommended)
  • 4 GB RAM or higher recommended
  • 10 GB free disk space

Network Requirements

  • Agent needs to be able to access the Acunetix 360 Application Server’s HTTP(S) (443/80) port

Required Access for Installation

  • Installation of the Agent requires Administrator rights

Minimum requirements for Invicti Enterprise Authentication Verifier Service and Authentication Verifier

These are the minimum requirements for Acunetix 360 Authentication Verifier Service and Authentication Verifier Agent.

Software requirements

  • Windows Server 2016 or above (Windows Server 2019 recommended)
  • .NET Framework 4.8

Hardware requirements

  • 1.4 GHz Processor (2 GHz or faster recommended)
  • 1 GB RAM (4 GB or higher recommended)
  • 2 GB Free Disk space (5 GB or higher recommended)

Network requirements

  • Authentication Verifier Agent needs to be able to access the Authentication Verifier Service's HTTP(S) port. (Default port: 5000)
  • Enterprise users should access the Invicti Authentication Verifier Service Hub publicly.
  • Authentication Verifier Service needs to be able to access the Acunetix 360 Application Server’s HTTP(S) (443/80) port

Required access for installation

  • Installation of the Authentication Verifier and Authentication Verifier Service requires Administrator rights

Minimum requirements for Acunetix 360 Bridge

These are the minimum requirements for Acunetix 360 Bridge.

Software requirements

  • Windows Server 2016 or above (Windows Server 2019 recommended)
  • .NET Framework 4.8

Hardware requirements

  • 1.4 GHz Processor (2 GHz or faster recommended)
  • 4 GB RAM or higher recommended

Network requirements

  • Acusensor Bridge Service needs to be able to listen to the Acunetix 360 Application Server’s HTTP(S) (7800) port

Required access for installation

  • Installation of the bridge requires Administrator rights

Minimum Requirements for the Database Server

These are the minimum requirements for the Database Server.

Information

Please note that the database is not provided by Acunetix. You must set it up yourself.

Software Requirements

  • Microsoft SQL Server 2016 or above (Microsoft SQL Server 2019 recommended)

Hardware Requirements

  • 1.4 GHz Processor (2 GHz or faster recommended)
  • 1 GB RAM (4 GB or higher recommended)
  • 6 GB Free Disk space

Network Requirements

  • Acunetix 360 Application Server needs to access this database server for the relevant port (1433 by default) or it needs to be on the same server

Required Access for Installation

  • Installation for configuring the Database Server requires either administrator or RDP access
  • Alternatively, database credentials or database owner permissions are required, along with the Name of an empty SQL Server database
  • The Database Collation field should be configured as case insensitive

Downloading the installer files

These files are conveniently downloaded in a .zip file.

How to download the installer files
  1. Download the Acunetix360.zip file you were emailed to your server
  2. Extract the .zip file to a directory
  3. Check that these five files are in the directory:
  • WebAppSetup.exe (Acunetix 360 Application Server installer)
  • AgentSetup.exe (Acunetix 360 Agent installer)
  • AuthVerifierSetup.exe (Acunetix 360 Authentication Verifier installer)
  • AuthVerifierServiceSetup.exe (Acunetix 360 Authentication Verifier Service installer)
  • IASTBridgeSetup.exe (Acunetix 360 Bridge installer)

Installing Acunetix 360 Application Server

Acunetix 360 Application Server is installed using a wizard.

The wizard has two parts:

  • Acunetix 360 Web Application
  • Acunetix 360 Authentication Verifier Service

Information

The Authentication Verifier Service is an optional part of this installation process. You can install the Authentication Verifier Service whenever you want. For further information about installing the verifier service, see Authentication Verifier Settings.

The following instruction explains how to install the Web Application and Verifier Service at the same time.

How to install  Acunetix 360 Application Server and Authentication Verifier Service
  1. Run the WebAppSetup.exe file and select Next.
  2. On the End-User License Agreement step, accept the license agreement, and select Next.

  1. On the Ready to Install step, select Next to install the Web Application Server, and wait for a while.

  1. The installation asks you to install the prerequisite: The Authentication Verifier Service.
  2. On the Welcome to the Prerequisites Setup Wizard window, select Next to continue.

  1. On the Select Installation Folder step, select Next to install the Authentication Verifier Service to the default folder. Or select Browse to select an installation folder. Select Next.

  1. On the Completing the Invicti Enterprise Authentication Verifier Service Setup Wizard step, select Finish to complete the installation.

  1. On the Completing the Invicti Enterprise Web Application Setup Wizard step, select Finish to complete the Web Application Setup process.

Next steps:

  1. Next, configure the Acunetix 360 Web App (see Configuring the Acunetix 360 Web Application Server Using the Installation Wizard.)
  2. Install Invicti Enterprise Scanner Agent (see Installing Acunetix 360 Agent).
  3. Then, install Invicti Enterprise Authentication Verifier (see Installing Acunetix 360 Authentication Verifier).
  4. Finally, install Invicti Enterprise IAST Bridge (see Installing Acunetix 360 Acusensor Bridge.)

Configuring Acunetix 360 Web Application Server Using the Installation Wizard

From the server URL on which the Acunetix 360 application is installed, you next need to run  the Acunetix 360 - Installation Wizard.

  1. The first step of the Installation Wizard is configuring the Database connection.
  1. Complete the fields to enable Acunetix 360 to build the necessary database structure and populate it with data. Select Next.

  1. On the Encryption page, select Download the Secret Key to download your key. Then, select Next.

  1. On the License page, select Import a License (.nsc file) and import your license file. Select Next.
  2. On the Account page, complete the fields to set up your account administrator account. Select Next.
  1. If you use cloud providers like Amazon AWS, you can configure the settings here (see Cloud Provider Settings). (If you don't use a cloud provider, deselect the Cloud Integration checkbox.) Select Next.

  1. On the Scanner Agent Settings page, copy the Access Token if you want to install the scanner agents following the installation wizard process. These agents will be used to scan target applications.

It is possible to skip this step by selecting the Continue without installing an agent checkbox.  

You can install agents whenever you want through Acunetix 360. If you want to install Agent at this step, execute the file AgentSetup.exe in the zip file. (For more information on agents, see Agents in Acunetix 360 On-Premises.). Select Next.

  1. On the Authentication Verifier page, copy the Service Token and the Access Token if you want to install the authentication verifier service and verifier agent following the installation wizard process.

Authentication Verifier Service and Verifier Agent are two components of Acunetix 360 On-Premises that are used to verify Form Authentication. They are optional components (see Authentication Verifier Settings). If the websites you are scanning do not use form authentication, you do not need these components.

It is possible to skip this step by selecting Next and setting up it later in Acunetix 360. If you want to set it up, select Install Authentication Verifier. The following page appears:

For further information, see Installing Acunetix 360 Authentication Verifier.

Select Next.

  1. You can configure SMS and email notifications to inform users instantly about the status of a web application security scan, or when specific vulnerabilities are identified on the web applications you are scanning. The next steps (Email and SMS) are for configuring E-mail and SMS notification settings (see Managing Notifications).

To send invitations to new users or other email notifications you need to configure SMTP settings. You also need to have a Twilio account to be able to receive SMS notifications.

It is possible to skip this step and next step by deselecting the Enable Email Notifications and Enable SMS Notification checkboxes.

Select Finish to complete the installation wizard.

Configuring proxy for Acunetix 360 Web Application

You may need to configure a proxy for the Acunetix 360 Enterprise Web Application.

Information

This instruction assumes that you installed Acunetix 360 Enterprise On-Premises to the default location, which is C:\Program Files (x86). If not, please change the relevant step in the instruction accordingly.

How to configure proxy for the Acunetix 360 Web Application
  1. Press the Windows logo key  + E.
  2. Paste the following into the address bar: C:\Program Files (x86)\Acunetix 360 Web Application.
  3. Open Web.config with a text editor and locate the proxy configuration line.

  <system.net>

    <!--<defaultProxy>

      <proxy usesystemdefault="True" proxyaddress="http://127.0.0.1:8888/"/>

    </defaultProxy>-->

  </system.net>

  1. Remove the comment characters from the proxy configuration line.
  2. Now, enter your proxy configuration.
  3. Save and close the Web.config file.

After saving the document, restart the IIS for changes to take effect. Setting proxy for the agent? See Setting Proxy in Scanner Agents.

Tips

In addition to the proxy address, you can also add information such as a bypass list to the proxy configuration. It looks like the following:

<system.net>  

    <defaultProxy>  

        <proxy  proxyaddress="http://127.0.0.1:8080"  

                bypassonlocal="True"/>  

        <bypasslist>  

            <add address="[a-z]+\.acunetix\.com$" />  

        </bypasslist>  

    </defaultProxy>  

</system.net>

Changing the installation folder for Acunetix 360 Web Application

While the installer does not provide an option to select the folder, you can do this once the installation is complete. To do this, follow these steps:

  1. Copy the installation folder (C:\Program Files (x86)\Acunetix 360 Web Application) to the target disk.
  2. Open IIS.
  3. From Sites, select Acunetix 360.
  4. Select Advanced Settings.
  5. Replace the physical path with the new path.

These steps help change the installation folder for Acunetix 360 Web Application.

Configuring Notification Settings

In the Acunetix 360 Application Server security scanner, you can configure SMS and email notifications to inform users instantly about the status of a web application security scan, or when specific vulnerabilities are identified on the web applications you are scanning.

To send invitations to new users or other email notifications you need to configure SMTP settings. You also need to have a Twilio account to be able to receive SMS notifications.

For further information, see Managing Notifications.

How to Configure Notification Settings
  1. Log in with an admin account.
  2. From the main menu, click Settings, then Email. The Email Settings window is displayed.
  3. Complete the form. If your SMTP server does not require a username and password, you can leave these settings empty.
  4. To configure your Twilio settings, from the main menu, click Settings, then SMS. The SMS Settings window is displayed.
  5. Complete the form.

Installing Acunetix 360 Agent

Acunetix 360 Agent is installed using a wizard.

Installing the Acunetix 360 Agent in silent mode? See Installing the Acunetix 360 Agent in Silent Mode.

How to Install the Acunetix 360 Agent
  1. Run the AgentSetup.exe file.
  2. On the Acunetix 360 Agent Setup window, select Next.
  3. On the Select Installation Folder step, select Next to install the Agent to the default folder. Or select Browse to select an installation folder. Select Next.

  1. On the Agent Settings window, enter the Agent Name, API URL, and API Token. The Agent Name and API URL fields are already completed. (Agent Name can be configured to any value to help distinguish them from one another, and the API URL should point to the WebApp URL.) Select Next.

Information

If you have already configured SSL/TLS for your Acunetix 360 Application Server, then you should enter that URL and ensure that you use HTTPS (for example: https://acx360server/).

Warning

To find your API Token, from the main menu, go to Agents > Manage Agents > Configure New Agent. Copy the Agent Token.

5. On the Ready to Install step, select Install.

6. Select Finish to complete the installation.

Configuring Agent Selection

If you wish, you can select a specific agent while launching a scan.

How to Configure Agent Selection
  1. Login to the Acunetix 360 Application Server with an admin account.
  2. From the main menu, select Settings > General. The General Settings window is displayed.

  1. Enable the Agent Selection Enabled checkbox and select Save.
  2. From the main menu, select Scans > New Scan. The New Scan window is displayed.
  3. In the General tab, select the Preferred Agent drop-down and select an option.

  1. Complete the fields as required.

Installing multiple agents on the same operating system

If you want to install more than one agent on the same system, first install Acunetix 360 Agent, as usual, using the AgentSetup.exe file.

How to install multiple agents on the same operating system
  1. Copy all files from the default Agent’s folder to the new Agent’s folder. The default installation path is: C:\Program Files (x86)\Acunetix 360 Agent.

For example, if you decided to use Agent-2 as the new Agent name, you could use this command to copy all files to new Agent’s folder:

xcopy "C:\Program Files (x86)\Acunetix 360 Agent\*.*" "C:\Program Files (x86)\Acunetix 360 Agent-2" /yie

This will create a new directory in C:\Program Files (x86)\Acunetix 360 Agent-2 and copy in all the required files.

  1. Locate the new Agent’s folder and open the appsettings.json file with a text editor. Set the new Agent’s name.

  1. Open a command prompt in Windows with Administrator rights and install the new Agent as a Windows Service using these commands:
  • This command changes the current folder to the new Agent’s folder:

cd C:\Program Files (x86)\Acunetix 360 Agent-2

  • This command installs the new Agent as a Windows Service:

Acunetix.Cloud.Agent.exe /i

  • This command starts the new Agent’s Windows Service:

Acunetix.Cloud.Agent.exe /s

Installing Acunetix 360 Authentication Verifier Agent

The Acunetix 360 Authentication Verifier Agent is installed using a wizard.

Information

Starting from the Acunetix 360 On-Premises 2.3, the Authentication Verifier Agent communicates with the Authentication Verifier Service to verify the login.

You can install the Authentication Verifier Agent without installing the verifier service. However, the verifier agent works properly only if you install the Authentication Verifier Service first.

For further information, see Authentication Verifier Settings.

How to install the Acunetix 360 Authentication Verifier
  1. First, run the AuthVerifierSetup.exe file.
  2. On the Welcome to the Acunetix 360 Authentication Verifier Setup Wizard window, select Next.

  1. Select Browse if you want to install the Authentication Verifier to a different folder than the default folder. Select Next.

  1. On the Authentication Verifier Settings step, enter the API URL and API Token. The API URL field is already completed. (It should point to the WebApp URL.) In the API Token field, enter your token. You can find this in API Settings. Select Next.

  1. Select Install.

Installing Acunetix 360 Bridge

The Acunetix 360 Bridge is installed using a wizard. For further information about AcuSensor, see Deploying AcuSensor in Acunetix 360 On-Premises.

  1. Run the IASTBridgeSetup.exe file.
  2. On the Welcome to the Invicti IAST Bridge Setup Wizard window, select Next.

  1. Select Browse if you want to install the Authentication Verifier to a different folder than the default folder. Select Next.

  1. On the Agent Settings window, enter the Service Port. By default, it is 7880.

  1. Select Install to complete the installation.

To set up a custom bridge URL for the Acusensor, see Deploying AcuSensor in Acunetix 360 On-Premises.

Securing Acunetix 360

Now your Acunetix 360 installation is complete, you need to make it secure. For further information, see Security Hardening for Acunetix 360 On-Premises.

 

« Back to the Acunetix Support Page