Scans and schedules
Scans run on one of your sensors or on one of our cloud scanners. Start one from Scans → New scan. To make it repeat, choose a When option other than Run now, once. [!NOTE] Org owners and admins, and people with the Operator or Administrator role, can run, edit, stop and delete scans and schedules. Viewers can see scans and their results. With a personal account you manage your own scans. Scan types Scan type (as shown in the console) What it's for Network vulnerability scan (OpenVAS) Hosts and services on your network: missing patches, vulnerable services, weak configurations. Add credentials for authenticated checks. Web, service & misconfiguration scan (Nuclei) Websites, web apps and network services: known CVEs, exposed panels, misconfigurations. WordPress sites: core, plugins & themes (Wordfence data) Finds the WordPress version, plugins and themes from public files, then checks them against the Wordfence vulnerability database. It doesn't log in or send attack payloads. TLS/SSL configuration: protocols, ciphers, certificates (graded) Grades every open port that speaks TLS. Discovery: live hosts & open ports Finds which hosts are up and which TCP ports are open. Active Directory assessment One domain, from your own sensor. See Active Directory. Cloud posture AWS, Azure, Google Cloud and Microsoft 365 accounts. See Cloud posture. Container images (beta) Public and private container images: vulnerable packages, leaked secrets and configuration problems. You enter images or tracked repositories instead of targets. See Container image scanning. Some scan types are only available on certain plans. If one isn't in your plan, the console marks it not in your plan. Targets Enter one target per line. What you can enter depends on the scan type: Scan type Accepted targets Network, Discovery Host names, IP addresses, CIDR ranges up to /16 Web/service (Nuclei) Host names, IP addresses, ranges up to /16, http:// or https:// URLs TLS/SSL Host names, IP addresses, ranges up to /16, https:// URLs WordPress Site URLs (for example https://example.com, or https://example.com/blog for a site in a folder) or host names. Ranges aren't accepted. IPv6 ranges can be up to /112. A scan can have at most 4,096 targets, counting both the targets you type and the ones from your target lists. While you type, the console checks your targets and warns you about any that the selected scanner can't use. On cloud scanners, stricter limits apply: public addresses only, ranges up to /22. See Cloud scanners. Target lists and port lists Use Targets & ports to save lists you want to reuse: Target lists take the same kinds of entries as above. One list can mix entries for different scanners, and the page shows which scan types can use each list. When you start a scan, the lists you pick are added to the targets you typed. Schedules always use a list's current contents. Port lists contain TCP ports and ranges, such as 22, 80, 443, 8000-8100. There are three built-in lists: Top 100, Top 500 and Top 1000 TCP ports. [!WARNING] If you delete a list that a schedule uses, the schedule's next run fails until you edit it. Scans that already ran keep their targets. Ports Network, Discovery and TLS/SSL scans have a Ports option. You can choose Scanner default, a port list, or Type ports… to enter TCP ports yourself. Network scans use the top 1000 ports plus common database and remote-access ports by default. Discovery and TLS/SSL scans use about 120 of the most commonly open ports by default. If a discovery would probe too many host and port combinations, the console asks you to narrow the ranges or ports. Scan options Find live hosts and open ports first (Network and Web/service scans, on by default). Network scans then scan only the hosts that answer, which is much faster on ranges. Hosts that drop every probe are skipped. Web/service scans then test every open port found, not just 80 and 443. URLs you enter are scanned exactly as given. Credentials let Network and…
OrbitalCyber documentation