Cloud scanners
Cloud scanners are scanners that OrbitalCyber runs for your internet-facing systems: websites, VPN gateways, mail servers and anything else with a public address. There's nothing to install. To scan systems inside your network, use one of your own sensors. To use one, start a scan as usual (Scans). In the Sensor picker, under Cloud scanners (internet-facing targets), choose Any available cloud scanner (recommended) or a specific scanner. Queues Every cloud scan goes into a queue, and scanners take work from it as they have room: Any available cloud scanner puts the scan in a shared queue. The first scanner that can run that scan type picks it up. This queue never refuses a scan, so it's the best choice unless you need a particular scanner (for example for its region or its egress addresses). A specific scanner puts the scan in that scanner's own queue. Each scanner accepts up to 25 waiting scans. When it's full, the console asks you to choose Any available cloud scanner or try again later. Scanners take turns between their own queue and the shared queue, so neither waits behind the other for long. While a scan waits, its status is queued, with its place in the queue: Waiting for any available cloud scanner · position 3, or Waiting in this scanner's queue · position 2. Stopping a queued scan takes it out of the queue straight away. Scheduled cloud scans can use Any available cloud scanner too. [!NOTE] Some plans don't include cloud scanners. If yours doesn't, the console says so, and you can scan from your own sensors instead. See Subscription for plans. Authorization Every cloud scan asks you to tick I'm authorised to scan these targets. The console shows this statement: I confirm that I own the targets of this scan or am authorised by their owner to test them, that scanning them from OrbitalCyber's cloud scanners is lawful, and that I accept responsibility for the scan. The scan doesn't start without this confirmation. Run again asks for it again. Your confirmation is recorded with the scan's target list. [!WARNING] Only scan systems you own or are authorised to test. What cloud scanners will and won't scan Public internet addresses only. Private, loopback, link-local, carrier-grade NAT, documentation, multicast and other reserved ranges are refused, both IPv4 and IPv6. Host names are checked twice: once when you start the scan, and again right before scanning. A name must resolve, and only to public addresses. A name that doesn't resolve is refused. Ranges up to /22 (IPv4) or /118 (IPv6), which is about 1,024 addresses. For a range, live hosts are found first, and each address is checked before it is probed. Up to 512 targets per cloud scan. Owners can opt out. A domain that publishes a DNS TXT record containing orbitalcyber-optout (or an address whose reverse DNS name is in such a domain) is never scanned by cloud scanners. See Opting out of scanning. A limited number of cloud scans run at once per organisation (3 by default). You can start more: they wait in the queue and run as yours finish. If some targets are refused, the form lists each one with the reason. Cloud scanners can run Network, Web/service, WordPress, TLS/SSL and Discovery scans. The scan types each scanner offers are listed under its name. Active Directory assessments run only from your own sensors. Cloud posture on a cloud scanner uses a connected cloud account (see Cloud posture). Allowing our scanners through your firewall Firewalls, WAFs and intrusion-prevention systems often block or rate-limit an address that sends many requests. That cuts scans short and hides vulnerabilities. Allow our cloud scanners' egress IP addresses. Console: the Cloud scanners page lists every scanner with its region, status and egress IP addresses. Download the IP list (CSV) gives the columns ip_or_range,version,scanner,region. API: create an API key with the cloud scanners read permission under API keys. Then fetch the list from a scheduled job: Without a key…
OrbitalCyber documentation