Set Up a New Domain in Web App Scanning
Objective
This guide explains how to set up a new domain in the Recon service in F5® Distributed Cloud Web App Scanning. Once the domain has been set up, the Recon service will automatically start discovering services exposed on the domain.
To follow this guide, you need the following prerequisites:
-
A Distributed Cloud Services Account. If you do not have an account, see Create an Account.
-
An apex domain (e.g.,
f5.com).
The purpose of the Recon service is to help you discover and map services exposed across your corporate domains. Once a service has been found, Web App Scanning will automatically attempt to fingerprint the software packages used by the service and look up the owner of the IP address the service is exposed on.
Step 1: Log into the Distributed Cloud Web App Scanning Console and set up a new domain.
-
Log into the Distributed Cloud Web App Scanning Console.
-
Click on Overview under Recon in the menu.
Figure: Recon
- Click on Add.
Figure: New Domain
-
Enter the domain you would like to scan using the Recon service.
- You can bulk create an array of domains by clicking on Bulk Add.
-
Enable Automatic domain discovery if you wish that Web App Scanning attempts to find other domains registered by your organization.
-
Enable Continuous scanning with Recon to automatically put your domain(s) on a monthly schedule. The Recon service will automatically run a new scan of your domain on the 1st day of every month.
-
Enable Test found services with Recon to have Recon create apps in the Scan service for all services found on the domain. F5 recommends disable this option, unless you are sure about the number of applications/services hosted on your domain.
-
Click on Submit.
Step 2: Review services found by Recon.
-
Once you have set up your domain in the Recon service, Web App Scanning will automatically start discovering its services. This may take several hours to complete.
-
If you have enabled email notifications on the Profile page, we will send an email once the Recon job has completed.
-
Once complete, you can review the services found by Recon.
Step 3: Reduce attack surface and set up further tests.
-
We recommend that you review each and every service found on your domain by the Recon service and assess whether you require to expose the service online. If you not, we recommend restricting public access to it by setting up a Network Policy.
-
Once you have reduced your attack surface and restricted access to applications that do not need to be exposed publicly, we recommend identifying your applications that expose sensitive data and/or functionality with the purpose of conducting further testing with the Scan service in Web App Scanning.
-
Review the guide for setting up new apps in the Scan service in Web App Scanning.
Note: The Recon service in F5® Distributed Cloud Web App Scanning mostly makes use of third-party services to discover the applications hosted on your domain(s). Though, to examine the server software packages used by your apps, we do send a few requests to each of your service. The amount of traffic is minimal and will not cause any service disruptions.