# Infrastructure Checks

<mark style="color:blue;">**Important:**</mark> Before running any scan ensure you have created a new product, where the scan results will be stored.

ScanSuite supports several infrastructure scan types:

***

**Vulnerability Scan**

This scan identifies open ports, running services, and related vulnerabilities across specified IPs or hostnames. The following scanners are supported:

* **OpenVAS**\
  Popular vulnerability scanner. Must be installed separately (refer to the _Administration_ section).
* **Nessus**\
  Commercial vulnerability scanner. Also requires separate installation.
* **Nuclei**\
  Widely-used vulnerability scanner. Included by default with the standard ScanSuite installation.
* **Custom Rules**\
  Executes rules created via the **Custom Rules** menu.
* **Bruteforcer**\
  Performs enumeration of known network services (FTP, SSH, SMB etc) and attempts the bruteforce using credentials from Credentials tab and popular username/password pairs.
* **AI Powered**\
  Performs the network discovery scan and queries the LLM for known vulnerabilities for the services versions.

**Configuration Notes:**

* Define scan targets and frequency.
* Optionally schedule scans.
* Choose whether to ping hosts before scanning ports.\
  &#xNAN;_(Recommended for internal scans to save time when scanning large subnets.)_
* Pick the scanning ports presets or provide own list via Custom scan ports option.

<figure><img src="https://4294115650-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnKyTIO2cfH1PztWRwJEe%2Fuploads%2F1Y0LUQxUWvT4X9GEvGYC%2Fimage.png?alt=media&#x26;token=8a4ca430-eae0-42f0-abf5-92b264e8c608" alt=""><figcaption></figcaption></figure>

***

**Network Discovery**&#x20;

Performs host and port discovery using **Nmap.** Supports ping hosts pre-checks and scan port presets:

<figure><img src="https://4294115650-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnKyTIO2cfH1PztWRwJEe%2Fuploads%2FxaKsBKivpbLvzQwDoJtp%2Fimage.png?alt=media&#x26;token=adb98090-b13d-4ea6-b8a5-036475b0f2dc" alt=""><figcaption></figcaption></figure>

***

**Local Patching Checks**

Checks for local OS patches over:

* **SSH (TCP 22)** for Linux
* **SMB/WMI (TCP 445, 139)** for Windows

**Supported Target Formats:**\
Hostnames, IP addresses, subnets, and ranges.

**Supported Linux Distributions:**

* Ubuntu: 16.04 to 24.04
* Red Hat: 7 to 9
* Debian: 9 to 12

**Scanning Tools Used:**

* **OpenVAS**: Supports authentication via username/password or username/SSH key pair.
* **Vuls**: Supports only username/SSH key pair.

<mark style="color:blue;">**Important:**</mark> Ensure you have the respective credentials provided via Settings menu.

**OpenVAS** patching scan results are uploaded to Defect Dojo automatically.

Results of **Vuls** scanner patching checks are not uploaded to Defect Dojo, but saved in individual XLSX files for each host, available to download via the **Report** button.

***

**Domains OSINT**&#x20;

Performs reconnaissance on specified domains, discovering:

* Subdomains
* Active hosts
* Leaked email addresses
* Compromised credentials _(requires Dehashed.com API key)_
* Host service and vulnerability data _(requires Shodan.io API key)_

**Input Format:**\
List of domains (comma-separated or newline-separated), e.g.,\
`example.com, another.org`

**Output:**

* Subdomains and associated data: Available via the **Report** button.
* Discovered email addresses and credentials: Accessible in the **Credentials** tab.

<mark style="color:blue;">**Important:**</mark> Ensure you have the Shodan and Dehashed API keys provided via Settings menu.

***

**Docker Image Scan**

Scans Docker images for known vulnerabilities in local packages.

**Usage Instructions:**

* Provide the full path to the image in the Docker registry.\
  &#xNAN;_&#x45;xample:_ `public.ecr.aws/portswigger/dastardly:latest`
* The image will be downloaded and analyzed by the scanner.

**Note:**\
Docker Registry authentication is currently **not supported**. Only **public images** can be scanned remotely or should be pre-loaded on the ScanSuite worker node.

