Configuring Acunetix 360 for Linux on Amazon Web Services (Ubuntu)

Acunetix 360 can be configured to run scanner agents on Amazon Web Services (AWS). When you launch a new scan, Acunetix 360 creates a new Linux instance for the target scan and terminates it automatically once the scan is completed.

This document explains how to configure Acunetix 360 for Linux on AWS to run scanner agents. For more information about using Cloud Providers with Invicti Enterprise, refer to Cloud Provider Settings.

There are 6 stages to this process:

1. Select a region
2. Create S3 buckets
3. Create IAM users
4. Create an AMI for the scanner agent
5. Configure Acunetix 360
6. Update the scanner agent

Step 1. Selecting a region

Acunetix 360 uses AWS S3 buckets for object storage and EC2 service for launching new instances.

For information on how to select a region, refer to Amazon's EMR documentation.

Step 2. Creating S3 buckets

Acunetix 360 needs three different buckets to store scan data. Follow the steps below to create S3 buckets.

1. Open the AWS console and navigate to the S3 service.
2. Create 3 buckets for raw scan data, screenshots, and customizations. For example, you can use bucket names like this:

• exampleinc.acx.scandata (for raw scan data)
• exampleinc.acx.scanscreenshots (for form authentication screenshots)
• exampleinc.acx.customizations (for customizations)

You can apply the following precautions to harden your buckets.

1. Enable Encryption: Amazon provides a default encryption service or you can use your own keys. For further information, Amazon S3 default encryption for S3 buckets.
2. Monitoring and Auditing: Amazon provides ways to monitor and audit S3 buckets. For further information, Amazon S3 Monitoring and Auditing Best Practices.

Step 3. Create IAM Users & Policies

During this step, you need to create the following:

• Access policy for the web application
• Access policy for the scanner agent
• Create a user for the web application
• Create a user for the scanner agent

3.1 How to create an access policy for the web application

1. Go to the AWS console and navigate to the IAM service.
2. Select Policies.
3. Click Create Your Own Policy.
4. Enter a policy name (e.g. ACXWebAppPolicy).
5. Enter your bucket names in the following policy template code and paste the code into the Policy Document field.

6. Select Create Policy.

3.2 How to create an access policy for the scanner agent

1. Select Policies.
2. Select Create Your Own Policy.
3. Enter a policy name for scanner agent (e.g. ACXAgentPolicy).
4. Enter your bucket names into the following policy template code and paste the code into the Policy Document field.

5. Select Create Policy.

3.3 How to create a user for the web application

1. Select Users.
2. Select Add User.
3. Enter a user name (e.g. ACXWebApp).
4. After creating the user, select Permissions
5. Select “Attach policies directly” and use the Customer managed filter
6. Select the previously created web app policy (e.g. NEWebAppPolicy).
7. Click Attach existing policies directly.

8. Click Next to create the web app user.
9. To create your Access Keys, select the NEWebapp user from the IAM page.

10. Open the Security credentials tab, scroll down to Access Keys, and select the option Application running on an AWS compute service.

11. Copy those into your notes for the Cloud Provider settings

3.4 How to create a user for the scanner agent

1. Click Users.
2. Click Add User.
3. Enter a user name (e.g. ACXAgent).
4. After creating the user, select Permissions.
5. Select “Attach policies directly” and use the Customer managed filter
6. Select the previously created web app policy (e.g. NEAgentPolicy).
7. Click Attach existing policies directly.

8. Click Next to create the NEAgent user.
9. Select the NEAgent user from the IAM page to create your Access Keys.
10. Select Security, scroll down to Access Keys, then select the option Application running on an AWS compute service.
11. Copy those into your notes for the Cloud Provider settings.

Step 4: Create an AMI for the Scanner Agent

There are three steps to this process:

1. Launch an instance for the scanner agent
2. Configure the scanner agent instance
3. Creating a scanner agent image

4.1 How to launch an instance for a scanner agent

1. Navigate to the EC2 service.
2. From the main menu, select Instances.
3. Select Launch Instance.
4. Choose Ubuntu instance base as the AMI.

5. Select Choose Instance Type and choose an Instance Type (c4.large is recommended).
6. Select Configure Instance.
7. Set the Auto-assign Public IP drop-down to Enable. (This is needed for RDP connections.)

8. Select Next: Add Storage and set the Disk Size (a minimum of 30 GB is recommended).
9. Select Next: Add Tags.
10. Select Next: Configure Security Group.
11. Select Review and Launch.

4.2 How to configure a scanner agent instance

You need to install the Acunetix 360 Scanner Agent to the target EC2 instance. There are three steps to install the agent on your Ubuntu instance.

• Configuring scanner agent instance
• Setting agent as a Linux service
• Add unit file for Acunetix 360

4.2.1 Configuring Scanner Agent Instance

1. Navigate to the EC2 service.
2. Select Instances from the main menu.
3. Right-click the previously launched scanner agent instance, and select Connect.

4. Connect to your instance with the supplied RDP information.
5. Ensure that you can connect to your on-premises Acunetix 360 web application from this instance.
6. Update the following operating system application repositories:

7. Install the following dependent packages:

Ensure your Mono version is version 5.20 or above. For more information, refer to How to update Mono at the very end of this document.

8. Create folder for Acunetix Scanner dependency:

sudo mkdir -p /home/ubuntu/.local/share/Netsparker_Ltd

sudo chown -R ubuntu /home/ubuntu/.local/share/Netsparker_Ltd

9. Install the Headless Chrome browser dependencies:

10. Next, extract the TAR file:

1. Download invicti-agent-release-onpremises-2.3.0.0.tar onto your Linux instance.
2. To extract the scan agent, run the following commands:

Open the appsettings.json file to enter the necessary information, such as ApiToken:

sudo nano appsettings.json

You need to configure the AgentInfo section of the appsetting.json file in the following way:

• AgentName: This must be invicti-agent
• AgentType: Navigate to the AgentInfo section and set agentType to Cloud.
• ApiToken: In the Acunetix 360 On-Premises, the Agent Token is displayed on the Configure New Agent page. Copy the value into the apiToken.
• ApiRootUrl: This is the URL of the Acunetix 360 On-Premises.

4.2.2 Setting agent as a Linux service

A cloud agent should be configured as a Linux service so that it can poll the Acunetix 360 servers regularly and can take the scan initiation command from the server.

4.2.3 Add a Unit File for an Acunetix 360 Agent

1. Open a terminal
2. cd /etc/systemd/system
3. sudo touch invicti-agent.service
4. sudo nano invicti-agent.service

5. Add the following script into invicti-agent.service

6. Save and close the document.

4.3 How to create a scanner agent image

1. Open the EC2 instances page on the AWS console.
2. Select the EC2 instance and from the Actions menu click Instance State > Stop/ Wait for the agent instance to be stopped.
3. Once the agent instance has stopped, right-click on it, and click Create Image. Enter a name for your image and click Create Image.

4. Navigate to the AMIs page and save your AMI ID (you will need it later).

Step 5. Configuring Acunetix 360

Follow these steps to configure Acunetix 360 AWS settings.

1. Create an RDP connection to your Acunetix 360 web application server.
2. Log in to Acunetix 360.
3. Select Settings > Cloud Provider from the left-side menu.
4. Enter your AWS settings.

• You can find the settings for the Instance Type, Subnet ID, and Key Pair Name in your stopped instance’s details in AWS.
• Click Security Group to get the Security Group id (e.g. sg-abc3fec2).

5. You can now run new scans on your AWS environment.

Step 6: Updating the Scanner Agent

Next, you need to update the scanner agent.

1. In the AWS EC2 console, open the AMI page. Right-click on your current scanner agent’s AMI and launch an instance.
2. Once your scanner agent instance is ready, make an RDP connection to it.
3. Download the Invicti Enterprise installation bundle. After downloading and extracting the invicti-agent-release-onpremises-2.3.0.0.tar file, configure your scanner agent instance as described in How to configure a scanner agent instance.
4. Next, log in to Acunetix 360.
5. From the main menu, select Settings > Cloud Provider Settings.
6. Enter your new AMI and select Save.

How to update Mono

You need to update Mono so that the Netsparker Helper Service can work properly. You can update Mono as specified below:

For Ubuntu 18.04:

1. sudo apt install gnupg ca-certificates
2. sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 3FA7E0328081BFF6A14DA29AA6A19B38D3D831EF
3. echo "deb https://download.mono-project.com/repo/ubuntu stable-bionic/snapshots/5.20 main" | sudo tee /etc/apt/sources.list.d/mono-official-stable.list
4. sudo apt update
5. sudo apt install mono-runtime