Before starting a vulnerability scan with AeyeScan, please confirm the prerequisites and precautions, change the target system settings, and notify the relevant stakeholders in advance.
｜ Table of Contents
Prerequisites for Use
1. Do not use AeyeScan against unauthorized environments
AeyeScan performs simulated attacks against the target system.
Please note that using it against unauthorized environments may be considered unauthorized access.
If you are using a shared/rental server, the impact of the scan may affect the entire server. Please be sure to check with your hosting provider in advance whether vulnerability scans are permitted.
2. Preparation for Domain Activation
Domain Activation is a procedure to verify that the scan target system is owned by you.
For setup instructions, please refer to "Step 4: Domain Activation".
* If the "Activation Skip" option is enabled, this step is not required.
3. Check the conditions for crawling
Please confirm that the target system meets the following conditions:
- Accessible via the Internet
- Accessible from the latest version of Google Chrome
- Input forms support Japanese or English
- Not using various Web authentications, or they can be temporarily disabled
- Not using WebSocket as a communication standard
For details, please refer to the following article:
https://www.aeyescan.help/hc/en-us/articles/37804927175193
Precautions
1. Perform vulnerability scans in a development or staging environment
AeyeScan does not intentionally perform operations that stop servers or services, but depending on the application design and server specifications, CPU load may increase, or servers and services may temporarily stop.
Unless there is a specific reason, we recommend performing scans in a development or staging environment rather than a production environment.
* The load on the server is approximately 10 requests / second.
2. Exclusion settings for functions not to be scanned
If scanning in a production environment is unavoidable and you are concerned about the impact of the scan as shown in the <Examples>, you can exclude the relevant functions from the crawl/scan.
For setup instructions, please refer to the following article:
https://www.aeyescan.help/hc/en-us/articles/37804931815193
<Examples>
| Scan Target Function | Concerns |
| Product purchase function on E-commerce sites | Possibility of purchasing a large number of products |
| Data deletion function such as user accounts | Possibility of deleting registered accounts |
| Inquiry function involving email transmission | Possibility of sending a large number of emails |
| Posting on SNS, bulletin boards, and data registration functions | Possibility of registering a large number of invalid characters |
| File upload function | Possibility of creating a large number of files |
3. Taking backups
Since the scan may modify data on the target system, we recommend taking a backup of the system and data.
Changing Target System Settings
1. AeyeScan exclusion settings in IPS/IDS or WAF
* IPS/IDS = Intrusion Prevention/Detection System, WAF = Web Application Firewall
If you have introduced equipment that blocks communication from the source in the target system, a large number of alerts may occur, and scan results may not be obtained correctly.
Please exclude AeyeScan's source IP address in advance.
* For setup instructions, please refer to the following article:
https://www.aeyescan.help/hc/en-us/articles/37803082323609
2. Disable restrictions on consecutive posts
If spam prevention measures such as prohibiting consecutive form posts are in place, please check the manual of your service and disable the restriction.
Example: How to disable "Prohibition of consecutive posts" in SPIRAL® by Spiral Inc.
https://support.smp.ne.jp/manuals/web/form/
3. Disable IP address restrictions
If the target system has IP address access restrictions, please exclude AeyeScan's source IP address in advance.
* For setup instructions, please refer to the following article:
https://www.aeyescan.help/hc/en-us/articles/37803082323609
4. Disable CAPTCHA, Multi-Factor Authentication, reCAPTCHA, etc.
If there is a mechanism to reject access from tools, please disable the function during the scan.
5. Disable throttling functions
If there is a throttling mechanism that limits the number of processes when a large number of accesses occur, please check the manual of the service you are using and disable the restriction.
How to change the settings for EC-CUBE® by EC-CUBE CO.,LTD. can also be checked from our technical blog below. https://qiita.com/AeyeScan/items/42d85984d4a035d26371
6. Recommended CPU resource settings in cloud environments (AWS, Azure, etc.)
If you are using instances that provide burst performance above the baseline by consuming CPU credits, such as the T series (T2, T3, etc.) on AWS or the B-series on Azure, AeyeScan may apply CPU load for a long time, depleting CPU credits and slowing down performance.
Therefore, we recommend considering changing to the following general-purpose types during the period when scanning with AeyeScan.
- For AWS environment: Change from T series to a general-purpose type such as M series.
- For Azure environment: Change from B-series to a general-purpose type such as D-series.
Notifying Stakeholders
1. Notification of scan execution
To prevent trouble, please ensure that relevant departments and system administrators are thoroughly informed of the scan execution using the following as a reference.
- AeyeScan's IP address
* For how to check, please refer to the following article:
https://www.aeyescan.help/hc/en-us/articles/37803082323609 - Scan schedule
- Possibility of data being registered / updated / deleted in the target system, etc.
2. Possibility of mass email transmission
For functions that involve sending emails, such as inquiries and document requests, the scan may result in a large number (thousands) of emails being sent.
If you proceed, please notify the relevant departments of the <Information to Share>.
<Information to Share>
- A large number of emails may be sent during the scan period.
-
Emails sent by the scan will contain the strings listed in the "Attachment_Input Value List" within the "AeyeScan Diagnostic Site Questionnaire" of the Questionnaire (Pre-scan Preparation Check Sheet). Please use this as a reference when distinguishing them from normal emails.
* The questionnaire can be downloaded from the following article:
https://www.aeyescan.help/hc/en-us/articles/37805546084249
3. Possibility of file generation if a vulnerability exists
If a vulnerability is found during the scan, a file containing the following string may be created, which may disrupt the page layout.
- aeyescan${Random 8-digit number}.txt
- aeyescan${Random 8-digit number}.php
4. Possibility of consuming disk space
Because AeyeScan performs simulated attacks against the target system, the Web server, applications, databases, mail servers, etc. may output a large amount of error logs.
Please ensure sufficient free space so that disk space does not run out even if a large amount (several GB) of error logs are output.
Also, if the development environment is set to record more logs than necessary, consider changing the log level.
5. Regarding server reboots
If the server is restarted during the scan, the scan results may not be obtained correctly.
Basically, please do not restart the server during the scan. If it is absolutely necessary, please contact our support desk in advance.
6. Confirmation of form input values
For the input values into the registration form by AeyeScan, please refer to the "Attachment_Input Value List" in the "AeyeScan Diagnostic Site Questionnaire" of the Questionnaire (Pre-scan Preparation Check Sheet).
* The questionnaire can be downloaded from the following article:
https://www.aeyescan.help/hc/en-us/articles/37805546084249