Penetrator Vulnerability Scanner Questions FAQ

It means only concurrent scans.
So if you have a 1 IP license you can still scan 256 IPs it will just do 1 at a time and queue the rest.
When it finish 1 it will do the next.
If you have a 8 IP license it will do 8 at a time.

You are allowed to change the IP and do all the scans you like.

I have a technical questions about "offline update" without directly connecting to Internet,
Is possible? 

Only update via connect to internet, but you dont have to be online to operate the Penetrator
So you can put it on laptop
Go on the Internet 1 time week to update and then just use it for offline mode in other time.

An example group can be like in this screenshot.

This is an example with 5 IPs in each group scan.

Normal group scan took 07:27:48 (7 hours, 27 minutes, 48 seconds)

Quick group scan took 03:56:21 (3 hours, 56 minutes, 21 seconds)

We get the errors

OVF Package Error following manifest file entry is invalid. SHA256

We have successfully fixed the issue regarding the lower version of ovf 5.5 esxi no longer supports SHA256 hence we downgrade to SHA1 which helped ovf function properly.

We have an issue with our Secpoint Penetrator virtual machine.

We don’t know when the issue occurred exactly

 I looks like the networking is kind a broken or something.

Within the web interface the right IP address is configured. We can connect to the internal IP address of the Penetrator website, but the machine cannot connect to the internet.

In the console of the VM, the network icon shows a red cross.

What can be wrong?

I can ping the IP from another PC successfully.

Solution:

You can close the ticket.

I found some strange stuff in our corporate firewall that blocked the connections.

Resolution problem that the resolution makes the browser to small and menu not shown.

It can be caused by the size of the browser window is too narrow. Put it at full screen to solve the issue or login directly to the IP address from a secondary machine

Do the Penetrator support Advanced AI and Machine Learning?

The Penetratort uses Advanced AI and ML in different areas including:

False positive vulnerability scan system to prevent high percentage of false positives to be found.

System Status where it can predict and prevent based on data future system problems.

On Protector: No proxy support because Protector send mail or make web filtering, and even act as a network bridge which is not possible under a proxy.
On Penetrator: vulnerability assessment can not be done behind a proxy that lets only filter 1 or 2 port.

You download Ghost4Linux and put it on a bootable USB flash drive with

https://sourceforge.net/projects/win32diskimager/

We would like to understand how do you come to the vulnerability "DNS Localhost 127.0.0.1 Vulnerability" for scanning specific IPs? Example:

Suggestion regarding when and what profile scanning we need to choose

It is not required to have Internet to run the program.

Does all the vulnerability scan logs are save locally on the Penetrator device? How large it consumes HDD space?

Correct everything is stored locally and you can also export all scan data In Vulnerability Menu > Download Reports
You can see free HDD space in System > System Logs

What is the process name on the target machine while the scanning is on progress? Some end user may ask about it. Or how much resources it consumes during a scan process.

It is designed to consume minimal amount of resources when doing a scan.
It will only sent necessary data based on services detected.

Vulnerability scan improvements

Domain Names visible on screen and reports The Penetrator allows to enter a domain name instead of an IP address when creating a scan. Starting with this firmware the domain names are visible throughout the whole scan process. This feature has been created for scans, scan templates, on scans created from a template and on the Scan Distribution page. The domain name will also be visible on the reports.

Detection of IP addresses

When a scan is created through a domain name, the corresponding IP address is automatically detected at the moment of the scan. When the scan is created from a template, schedule or repeated from a previous scan, the IP address is now detected immediately before launching the scan, not when the template or schedule are created. This behavior allows to detect the correct target from the corresponding hostname when the target’s IP address is assigned through a DHCP server, and is subject to change over time.

Repeated Scans

Two new features are available on the Repeated scans. It is possible to alter the scan parameters, for example when it’s necessary to alter the scan profile or the port numbers of a previous scan leaving all the other parameters unchanged. The second feature is the possibility to repeat a previous scan on the nodes that were offline on the previous scan. To do this, click on the red button Repeat Scan on the scan row.

Operating System Name

The operating system of the target node is now displayed on the report. The operating system is detected through a set of algorithms, and may not always be 100% accurate. The operating system is shown in a separate chapter of the report.

The Google Authenticator is an implementation of the Two Factor Authentication (2FA). 2FA is a means of making account logins more secure. In addition to username and password, it requires a Time-based One-time code that can only be generated by the legitimate owner by means of a hardware device.

This feature is available through menu System > 2FA Login Protection   To enable this option, you should first download the Google Authenticator app on your iOS or Android smartphone.   When the app is installed, you should initialize it by scanning the QR code displayed in the 2FA Login Protection page. After that, the Google Authenticator app will start generating numbers.

When the app is installed, you should initialize it by scanning the QR code displayed in the 2FA Login Protection page. After that, the Google Authenticator app will start generating numbers.

To proceed, you need to do the Code Verification: type the

number displayed on your smartphone in the entry field on this page. If you see the green check mark next to the code, it means that the code has been accepted.       If the Code Verification is unsuccessful or hasn’t been performed, the Google Authenticator option remains disabled and a warning message will invite you to complete it. At the end, the Google Authenticator login option can be enabled.        When you want to disable the Google Authentication, you need to do the Code Verification as well. When the option is enabled, the Penetrator login page requires an additional field, the Google Authenticator Code, that can be read on your smartphone. If you omit this code or if the code incorrect, the login is denied.

When this option is enabled, to access the SecPoint® Penetrator you will always need to have your smartphone with you. In case of access problems, you should contact the SecPoint® Support.

Starting with this firmware, a new User Interface is gradually replacing the previous one. Along with this, most of the existing functions are subject to rewriting, to comply with the new interface and for more robustness. Here are the main features of the new interface:  New layout with different colors: Top banner, tables menu and widgets in different shades of gray  Responsive design, for a better experience on classic and touchscreen devices  A larger window is available for displaying data  New left-side menu, usable on touchscreen devices  New User menu on the top banner

New widget for on-off switches    Collapsible right-side panel with overall status always visible on the page. The available states are OK, Information, Warning, Error. Ø  Flashing icons to emphasize issues     Ø  Data tables with paging, filtering and sorting  Multiple selection and actions on multiple items at once

abs to display multiple pages at once  The new user interface is currently available on the following menu items:-          Vulnerability Scanner > Download Reports-          Cloud Users > User Management-          Scan Distribution

I am trying to run a new vulnerability scan with our device but it says "You can't make any more scans."
I'm logged in as admin
under "User Statistics" it says: Total scans left 0
any idea how to fix this?

Solution:

If you see the picture, the user has zero scans left. You can change this restriction in the user management, parameter Scan limit.

My Penetrator cant sent mails.

You need to put in your ISP relay server.

This can be done here

System > Smart Host Relay

A customer has a very interesting question 

1)      Let say I got a Penetrator with a 1 IP license online in a Cloud VM

2)      I got a SFF Penetrator appliance 8 IP in a remote network behind a NAT router

3)      Let say I got the master/slave Penetrator working ( we still got it NOT working)

4)      When I create a scan on the “cloud” penetrator to the slave Penetrator Can I start a scan of 8 devices on remote SFF from the Master 1 IP cloud Penetrator?

Reply:

The license type creates a funnel that defines the way the Penetrator starts scans. In the case of a master-slave architecture, the two funnels do not combine, so that the master and the client Penetrators will launch scans depending on their own license only. In your case, the client Penetrator will receive the command to launch the scan of one or more IPs even if the master is already processing another IP. So, you may create a scan of 9 IPs and let the master process one and the client the remaining 8, that would be launched simultaneously.
If the master-client is not working, please upgrade to the latest firmware on both units and retry. If it shouldn't still work, please open the remote support.

May we know if their is an performance impact to the device if secpoint penetrator is in the process of scanning the vulnerabilities on that device?

It is designed to cause minimal impact and not interrupt with production systems.
So even if you scan a production enviornment during business hours the customers should not see any difference.
Often with poorly written opensource tools if using during production hours can end in target systems to crash.
We have designed our tools to not crash the target system or lower performance.
You can via the more agressive scan profiles still perform DoS and exploits

If their is no impact, what scanning technologies that secpoint do to avoid performance issue during scanning?
It is good written code that takes into account not to crash things.
Only if you choose the agressive profile it will try and crash the target system.
It is also designed to not sent data if it has not detected a service.
So it keeps minimize the data footprint on the network in each scan.

A new feature in the schedule options allows to plan the launch of a vulnerability scan with more accuracy. Through this option it’s possible to specify the date and time when a scan must be launched and optionally the number of days to wait before the scan should be launched again.

Schedule scans are available through menu Schedule.

When you are creating or modifying a schedule, the list of frequencies contains the new option “On Date”, where you can enter the date and time when the scan will first be launched.

If the scan should be repeated, enter the number of days between the first scan and the next one in the entry field on column Repeated. In this example, the scan will be first launched on Friday, August 10^th 2018 and repeated every 2 weeks, on Fridays, at the same time: August 24^nd, September 7^th etc.

With option “On Date” it’s also possible to launch a scan later in the same day.

Please take into account that a 1-time schedule scan will not be deleted when the scan has been completed, and it will remain in the list of scheduled scans even if won’t be launched again.

In this picture scan “Old schedule” has been performed on January 1^st 2018 and will not be repeated. If no more necessary, a schedule can be deleted. If you need to schedule it again in the future, you can edit the schedule and change the start date/time.

In order to avoid any valid user to remain locked out of the door of the Penetrator when the code generator is unavailable, a Recovery Code is now available.

This code is displayed on screen in the 2FA page (Menu System > 2FA Login Protection) and is only visible when the 2FA feature is enabled.

This code must be copied and stored in a safe place and only used in case of emergency to disable the 2FA feature.

The 2FA feature can be disabled by logging in to the Penetrator’s command line, and opening the Recovery Console. Here, option 16 will ask to type the recovery code and, if the code is valid, will disable the 2FA feature. The recovery code is unique to each Penetrator, therefore it can only be used to unlock the unit where it was generate

When a vulnerability found on a specific target can be referred to a code in the CVE database operated by the Mitre Corporation, the Penetrator will automatically find the corresponding CVSS score for both V2 and V3 versions of CVSS.

The CVSS score will then be displayed on screen and on the reports whenever a CVE code is available.

The CVSS score is available on screen in the detail of vulnerabilities: when you click on a snapshot icon , the list of the vulnerabilities for a scan is displayed.

Here, clicking on the name of a vulnerability, the Penetrator shows the page with the details:

The same information is also available on the reports.

Please take into account that the reports available on the home page have been created at the end of each scan. Therefore, to get the CVSS score, it’s necessary to generate new report: click on Make New Reports in the floating menu in column Options next to each scan.

The CVSS scores are updated frequently, and the Penetrator keeps its database up to date accordingly. The Penetrator automatically updates the CVSS scores every night between Midnight and 1 AM. This process is necessary and may require some time if it’s not performed frequently.

What is the approach and what engine it uses to detect malwares?

Yes if it comes in via the Network.
The customer still need a malware scanner on the PC to protect from USB disks.

What is the approach and what engine it uses to detect malwares?

Only if they open services/ports.
Penetrator scan over network
If something on hdd you need antivirus to scan locally.
But most antivirus is not effective.

So you need use our Protector UTM Firewall with Intrusion Prevention module to block malware before it even gets to the hdd.