External Scan

Running External Scans using CyberCNS

• Choose a company for which you need to run a scan, and navigate to External Scan to create a profile.

  

Profiles

Users can create different profiles based on the requirement and attach them to assets to be scanned for external scans.

• In the profile sections, you can create your own profiles and can add these profiles in the Configurations section.

• There are three Default Profiles, that are

🔹 Quick Scan: This covers the top 1000 ports defined by IANA, which covers up to 65% risk profile.

🔸 Detailed Scan: This covers the top 3500 ports defined by IANA, which covers up to 94% risk profile.

🔹 Deep Scan: This will scan all 65535 ports, this can take 10 minutes to hours.

• If you want to create your own Custom Profiles click on +Add.

• In the profiles section, enter the Profile Name as required and select the Port Scan Type.

• There are two types of Ports, those are Top Ports and Custom Ports.

Top Ports

• In Top ports, you can choose the number of ports(100, 500, 1000, 3000, 5000, 10000, and 65535 ports) as required.

• Choose the Protocols as required.

🔹 Sync

🔸 Connect

🔹 Xmas Scan

• Choose the Service Detections as required and click on Save.

• Once the profile is created successfully, you can either Edit or Delete the created profile in case required.

Configurations

• When the profile is created, navigate to the Configurations section and click on +Add to add the External Scan Endpoints.

• Select the Discovery Type as required.

🔹 IP Range: Discovery Type selected as IP Range, then please provide the Start IP and End IP of the range selected.

🔸 Static IP: Discovery Type selected as Static IP, then need to provide a single IP address to scan.

🔹 Domain Name: Discovery Type, selected as Domain Name, then need to provide a Domain Name.

• The created profile can be chosen here if required, if not can select the Scan profile.

• Enter the Ignore ports for the required IP address. Once you add the "ignore ports" option, CyberCNS will no longer generate alerts, even if the port is open

• To add multiple ports, enter a port and press comma or press enter to add.

• Once all the details are provided, click on Save.

• Select the checkbox of Exclude from scanning in case an IP exclusion is required.

• Select the Scan Later option, to save the credentials and scan later.

• Ports that have been added as Ignore ports will not be considered for alerts. 

• If any ignored port has been added and it contains vulnerabilities, those vulnerabilities will contribute to the calculated risk score and will not be ignored.

• If the IP has been discovered with four open ports if we add all four discovered ports as ignored ports added as 443,80,20, and 8080 contributes to the calculated risk score will be low.

• If four ports are discovered if the two ports are ignored the risk score will remain the same, if we add all the discovered ports contributes to the calculated risk score will be low.

• The external scan result will be the same as before.

• In general, when you designate a specific port as an ignored port, such as port 443, it means that alerts will not be triggered specifically for that port. Instead, alerts will only be generated for the remaining open port, such as port 80. This allows you to focus on monitoring and receiving alerts for the designated open port while disregarding alerts for the ignored port.

• In general, if you designate port 443 as the ignored port in the configuration, the alerts for that port will not be received. However, if you edit the configuration to make port 22 secure and initiate a scan for old results only, the status for that port will show as closed. Conversely, if you remove port 22 from the secure list and initiate the scan again, a new entry will be created in the old alerts list with the status set as open until the port is removed from the ignore ports.

• To start the scan, select the checkbox to Scan the added IP and then click on Scan Now under Global Actions, or under the Action select the option Scan Now.

• Click on Upload Bulk IP CSV File.

• Click on Upload to upload bulk in CSV file format. You can make use of sample CSV file to upload the correct format data.

• There is an option to Edit or Delete the Discovery Type using the Action column. Any Discovery Type can be edited or deleted if needed.

Jobs

• When the scan begins, navigate to the Jobs section to check the Job Completion.

Results

• Once the scan is completed, navigate to the Results section, to view the details of the added IP.

  

• Multiple Results can be Deleted and Details if chosen using the Actions menu as shown below.

• Information such as Ports Scan, Protocol Scan, Service Detections, OverAll Grade, Open Ports, Vulnerabilities, and Operating System Details will be displayed.

Custom Ports

• For custom ports, enter multiple ports of your own by adding commas. Choose the Protocols as required from below:

🔹 Sync

🔸 Connect

🔹 Xmas Scan

• Choose the Service Detections as required and click on Save.

• For the added IP can get the details based on the Selected profile.

• Overall Grade, Open Ports, Vulnerabilities, Operating System Details, Common SSL Vulnerabilities, and Certificate details will be displayed.

• One can download the individual External Scan result by clicking on the download icon( ).

Web Vulnerabilities

• Click View Details under the Vulnerabilities section to get more information about the vulnerabilities.

• Details such as Category, CVSS, Severity, Remediation, Impact, and Description are captured for Vulnerabilities.

SSL Attacks and Certificates

• Common SSL Vulnerabilities like DROWN, POODLE & HEARTBLEED are checked for.

• SSL Certificates if any are found on the system, the details as shown below will be available in this section.

• This completes the documentation for External Scan.