Guide To Acunetix 360 Basics - Newtech

Guide toAcunetix 360Basics

Contents334Step 01 Learning the BasicsWeb Application Security Scanning FlowStep 02 Installation4Acunetix 360 On-Premises4Acunetix 360 Online5Step 03 Setting Up Your Team & User Permissions6Step 04 Adding Target Website Applications6Verifying Ownership7Step 05 Launching a Scan7Using the Default Settings7Using Customized Settings8Step 06 Reviewing Scan Results8What Is Going on During Scanning?9What Information is Available Following the Scan?9What Should I Do with Detected Issues?101011Step 07 Creating A Scan ReportWhy Do We Need Reports?SupportGuide to Acunetix 360 Basics2

1LEARNINGTHE BASICSWelcome to Acunetix!1Knowing your web application2Preparing and configuring scans3Scanning your web applications4Reviewing and comparing scan resultswith previous scans5Fixing issues6Retesting fixed issues7Generating reportsWeb security might seem like a daunting concept,but with Acunetix 360, you can start scanningtarget web applications immediately.Acunetix 360 is an automated, yet configurable,web application security scanner. It enables you toscan websites, web applications and web services inorder to detect vulnerabilities and other issues thatmay be useful to malicious attackers. It also isdesigned to become a part of your completecybersecurity environment and integrate with manyother solutions.ACUNETIX 360LEADER IN ACCURACYAcunetix 360 is one of the leaders in termsof accuracy and employs several differenttechniques aimed at reducing falsepositives. Acunetix 360 provides a Proof ofA COMPLETE WEBSECURITY SOLUTIONExploit, meaning that you can avoidwasting time on manual verifications. Thisenables you to spend time fixingvulnerabilities instead.Acunetix 360 is available Online orOn-Premises. It allows you to scan multiplewebsites at the same time, providesdashboards that deliver an overview of thesecurity state of your web applications, andWEB APPLICATION SECURITYSCANNING FLOWlots of features to help you to scanwebsites, manage issues and run reports.Acunetix 360 is one of the leaders in terms ofaccuracy and employs several different techniquesaimed at reducing false positives. Acunetix 360provides a Proof of Exploit, meaning that you canavoid wasting time on manual verifications.Helpful links for further information:This enables you to spend time - Whatvulnerabilities instead.- lication-security-scanning-flow/Guide to Acunetix 360 Basics3

2INSTALLATIONNow that you know how Acunetix 360 works, here isa quick look into the deployment differencesSYSTEM REQUIREMENTSbetween Acunetix 360 On-Premises and Acunetix360 Online.A complete installation of Acunetix 360 has4 components, with the followingrecommended requirements:ACUNETIX 360 ON-PREMISESAcunetix 360 On-Premises is an edition that youinstall on your own infrastructure. The typicalmotivation behind this choice is to keep all theresulting data stored in-house.Acunetix 360 Application Server Windows Server 2019 with IIS role and.NET Framework 4.7.2 2GHz Processor or faster 8Gb RAM or moreFor more details regarding the installation steps, 20Gb Disk space or morestart with Installingand Configuring Acunetix 0-on-premises/Acunetix 360 AgenthOn-Premises.t ps:/ w w.acunetix.com/sup ort/docs/a360/get ing-started/instal ing-and-configuring-acunetix-360-on-premises/ Windows Server 2019 with .NETFramework 4.7.2Once the installation is complete, you can log in 2GHz Processor or fasterusing the credentials created during the installation. 4Gb RAM or more 5Gb Disk space or moreACUNETIX 360 ONLINEAcunetix 360 Online is a cloud-based webapplication security scanner. As soon as yourAcunetix 360 Authentication Verifier Windows Server 2012 R2 with .NETFramework 4.7.2license is activated, you will receive an invitation 2GHz Processor or fasteremail. Simply click on the link in the invitation email 4Gb RAM or moreto create your credentials, and then log in. 5Gb Disk space or moreDatabase Server Microsoft SQL Server 2012 or later 2GHz Processor or faster 4Gb RAM or more 6Gb Disk space or moreGuide to Acunetix 360 Basics4

3SETTING UP YOUR TEAM& USER PERMISSIONSNow that you have logged in to your Acunetixaccount, let's look at how to set up your team anduser permissions.ADMINISTRATIVEACCESS REQUIREDManagement of Teams and UserPermissions is restricted toAdministrator-level users only.Setting up user permissions at the beginning meansthat the relevant users will have access to therelevant features. They can get started detectingand fixing vulnerabilities immediately.t ps:/ www.acunetix.com/sup mbers-in-acunetix-360/1. To set up your team, go to ersineam-managementAcunetix2. For each team member, you also need x-360/ConfigureUser Permissions in Acunetix 60/The UserPermissions Matrix in Acunetix 360will help you understand what each permissionenables users to do.USERS WITH ADMINISTRATORPERMISSIONS CAN CREATEAND MANAGE TEAMSGuide to Acunetix 360 Basics5

4ADDING TARGETWEBSITE APPLICATIONSNow that you have set up your team and userpermissions, it is important to understand how toadd a target website. Adding your target websitebefore launching a scan is a necessary step so thatAcunetix knows which sites you would like to scan.VERIFYING OWNERSHIPYou can Verify Ownership of a Website by HTMLFile Upload, Meta Tag Verification, TXT Records inDNS Verification or Email Verification. You can dothis in the Manage Websites window. Complete therelevant fields. Follow the instructions in Verifyinght ps:/ w w.acunetix.com/sup ort/docs/a360/get x-360/Important Licensing Information1. Acunetix 360 licensing revolves aroundWebsitehttps:/ -360/We recommend that you act responsibly and makethe number of targets that you enter intosure that you are authorised to scan the websitethe system. Once a domain name hasfirst. Remember that during the scan your websitebeen scanned, it counts towards yourwill be attacked. See tions/license; you cannot switch out a site thatWebhttps:/ -acunetix-scans-damage-web-applications/has already been scanned for a differentsite you need to scan.2. Remember to delete any domain namesadded during your Acunetix 360 trial.3. Keep in mind that you can change yourdomain names only once a year.Acunetix 360 Online users need to verify theownership of this website prior to scanning. If youhave multiple websites to scan, you can contact theAcunetix support team to whitelist your account.This will enable you to scan all your websiteswithout ownership verification.Adding A Website1. ClickWebsite, then New Website2. Complete the Name, URLand other information.3. ClickSAVEGuide to Acunetix 360 Basics6

5LAUNCHINGA SCANYour target websites are all set up and you areFor example, many web applications have sectionsready to launch a scan. There are two ways to doreserved only for authorized (signed-in) users. Inthis. You can either use the default settings, or youthese cases, you can configure variouscan configure them for an optimized andauthentication methods, to make sure Acunetix 360faster scan.has access to those sections, and can conductscanning there too. See Typeshttps:/ erview-of-scanning/ for moreUSING THE DEFAULT SETTINGSscanning options.Acunetix 360 is an easy to use, automated webapplication security scanner. It provides manyGeneralFormScopeBasic, NTLM/KerberosMaximum Scan Duration, Scan Scope, Heuristic URLAdditional WebsitesHeaderRewrite Mode, and Notifications. This makes it easyImported Linksdefault configurations including: Default ScanPolicy with built-in Security Checks, Report Policy,to get started quickly. To understand the scanURL /a360/scans/creating-a-new-scan/settings in detail, start with Creatinga New Scan.Scan Time WindowSCAN DURATIONPCI ScanRemember that scan duration may varydepending on the size of the webapplication and the security checksenabled in the Scan Policy you’ve selected.To understand each setting and how to configure s/creating-a-new-scan/see Acunetix360 Scan Options Fields.CUSTOM SCAN PROFILESUSING CUSTOMIZED SETTINGSIf you decide to configure some or all ofAuthentication and Scope settings are verythese options in Acunetix 360, you can saveimportant for a web application scan. If you enteryour configuration as a Scan Profile (seethe proper configurations, Acunetix 360 will fineOverviewof Scan 0/scans/overview-of-scan-profiles/ to reuse it fortune itself automatically. However, in some cases,future scans. Saved Scan Profiles areyou may want to consider customizing scans byavailable by clicking the gear icon.configuring further scan settings.Guide to Acunetix 360 Basics7

6REVIEWINGSCAN RESULTSNow that you’ve launched your scan, you are readyto review the scan results. Reviewing scan results inWHAT IS GOING ON DURING SCANNING? the Issues and Dashboard windows is important forAcunetix 360 is crawling and attackingdiscovered pages.several reasons. -started/introduction-to-the-dashboards/Start with Viewingthe Scan Summary DashboardIn the Issues window, you can see a list of eachhttps:/ www.acAcunetixunetix.com/support/docs/a360/get ing-started/introduct360ion-to-the-dashboards/ to see the discovered issuesinindividual issue and where it was found. You canduring scanning.find out about the varying types of findingsdetected on your scanned websites, not just thevulnerabilities. Some of these include informationthat may be useful to attackers.1Learn vulnerability severity levels2Gain an overview of the security state3Check the scan summary and impacts4Review the issues and remedies5Fix the vulnerabilities and retest6Update the status of the issuesIn this section, you will learn how we categorisedetected vulnerabilities, how to interpret ongoingand completed scan results, and what to do onceyou have fixed an issue.First, read up on vulnerability-severity-levels/Vulnerability Severity Levels, soyou can understand how we categorise detectedvulnerabilities in scan results (by severity). This willhelp you prioritize which ones to tackle first.Guide to Acunetix 360 Basics8

WHAT IS GOING ON DURING SCANNING?You can view the dashboards again; or you can gain an overview of the security state of all your webapplications by -started/introduction-to-the-dashboards/Viewing the Global Dashboard in Acunetix 360; or you can get a detailed view of all issues sues/viewing-issues-in-acunetix-360/by ViewingIssues in Acunetix 360.1361Severity m25/06/19LowInformation27/0627/06/19Best Practice30/06/19CriticalLowHighMediumInformation Best PracticeTHE GLOBAL DASHBOARDPROVIDES YOU AN OVERVIEWOF THE SECURITY STATEWHAT SHOULD I DO WITH DETECTED ISSUES? tps:/ www.acunetix.com/support/docs/a360/is ues/viIssues.ewing-is ues-in-acunetix-360/First, have a look at htManaging xt, move on to Fixinga Vulnerability and Updating the Status of an Issue in Acunetix 360.Guide to Acunetix 360 Basics9

7CREATING ASCAN REPORTNow that you have reviewed your scan results, youAcunetix 360 allows you to generate PCIcan create various types of reports. Reporting is thecompliance reports, approved by an ASVlast stage of the Web Application Security Scanning(Approved Scanning Vendor).Flow and an important one, because it gives different users and departments all the 0/reports/built-in-reports/ - Including generic Trend andBuiltin t/ReportsStatus security reportsthey need to take care of in their areas of responsibility. 0/reports/report-templates/ - For generating andReportdownloading reports, includingWHY DO WE NEED REPORTS?Managers need security reports that cover basiccompliance reports https:/ etix-360/Statisticalinformation on discovered issues and possibleht ps:/ rview-of-reports/impacts. For further information see WhyhtNeedtps:/ /overview-of-reports/Developers require more detailed information inorder to begin fixing detected vulnerabilities.In addition to rted-vulnerabilities/ you can alsogenerate a DetailedScan reports/built-in-reports/REPORTS HELP YOU MEETCOMPLIANCE REGULATIONSSUCH AS ISO 27001,HIPAA AND PCI.Guide to Acunetix 360 Basics10