www.invicti.com Open in urlscan Pro
52.203.139.57  Public Scan

Form analysis
1 forms found in the DOM

GET /support/search/

<form class="" action="/support/search/" method="get" role="form" __bizdiag="113" __biza="WJ__">
  <div class="input-group">
    <input type="text" name="q" class="form-control" placeholder="Support Search">
    <span class="input-group-btn ">
      <button class="btn search-btn btn-tparent noshadow noborder bg1" type="submit">
        <span class="glyphicon glyphicon-search c11"></span>
      </button>
    </span>
  </div>
</form>

Text Content

Get a demo
Get a demo
 * Product
   Overview Features
 * Why Invicti?
   Solutions
   INDUSTRIES
   IT & Telecom Government Financial Education Healthcare
   ROLES
   CTO & CISO Engineering Manager Security Engineer DevSecOps
   Comparison Case studies Customers Testimonials
 * Pricing
 * About Us
   Our Story In the news Careers Contact us
 * Resources
   Blog White Papers Webinars Resource Library Partners Support

 * Home
 * Support
 * Scans
 * Introduction to Scan Policies

SUPPORT

Contact Support

OPEN A TICKET

In This Topic:

 * Why use Invicti Hawk?
 * What vulnerabilities does Invicti Hawk detect?
 * How does Invicti Hawk work?

This document is for:

 * Invicti Standard
 * Invicti Enterprise On-Premises
 * Invicti Enterprise On-Demand


HOW INVICTI HAWK FINDS VULNERABILITIES

Hawk is the infrastructure the Invicti web application security scanner uses to
detect Server Side Request Forgery (SSRF), and all other kinds of blind,
asynchronous and second order vulnerabilities that require data to be sent over
out-of-band channels.

> For more information on what Invicti Hawk does, why it was built, and the
> types of vulnerabilities it finds, watch as Invicti’s former CEO Ferruh
> Mavituna talks about it on Paul's Security Weekly #506. Ferruh explains in
> detail how Hawk can find out-of-band vulnerabilities and why it uses DNS
> lookups to determine if the target web application is vulnerable.


WHY USE INVICTI HAWK?

Most common types of SQL Injection, Cross-site Scripting and similar
vulnerabilities can be detected fairly easily. The scanner sends a request to
the target web application. Once a response is received, it analyses this
response to determine whether the target is vulnerable. For example a typical
SQL Injection vulnerability can be identified from an error message or content
changes in the response, or the time the page takes to load.

Not all vulnerability detection, however, is as straightforward. 

 * For example, if the request sent to the web application is queued and
   processed by another block of asynchronous code - even if the code that's
   processing the input is vulnerable to SQL Injection - there won’t be any
   error messages, content differences, or time load differences in the
   response. 
 * To detect vulnerabilities like this, the scanner forces the code to respond
   via a different communication channel ('out-of-band'). 
 * Invicti Hawk is the intermediary server (the different communication channel
   that will receive these signals). The scanner communicates with it to confirm
   these types of vulnerabilities.


WHAT VULNERABILITIES DOES INVICTI HAWK DETECT?

Invicti Hawk also finds vulnerabilities that benefit from out-of-band detection,
or can be only detected with this way, including the following:

 * Out-of-Band SQL Injection
 * Out-of-Band Remote File Inclusion
 * Out-of-Band Code Injection
 * Out-of-Band Code Evaluation
 * XML External Entity (XXE) Injection
 * Server-side Request Forgery (SSRF)
 * Blind Cross-site Scripting
 * Log4j vulnerability


HOW DOES INVICTI HAWK WORK?

This is how Invicti works.

 1. During a web security scan, Invicti generates a custom hash and uses it in
    the attack payload. For example, it sends the following request to the
    target web application:

https://example.com/fetch?id=13&url=rc0shnxclpkdrp9oy-nibgsbz7u5ibyjddtzp0rezw4.r87.me/r/

Copy





 2. If the target web application is vulnerable, it tries to resolve the URL by
    contacting our DNS server.
 3. On receiving the request, the DNS server hashes it and sends it to the
    database server, together with the type of the request. For example:

d057a29eb9d43456054ff79b421c36a1d0678768bb7b01adae2f8b025add6df8, DNS

Copy





 4. Next, the Invicti scanner queries the Hawk server, which checks with the
    database server for the hashed record.
 5. Once the scanner receives the hashed value, it applies the same hashing
    algorithm to the local data that the DNS server used. If both the hashes of
    the scanner and the DNS server match, it means that the target web
    application is vulnerable. Invicti can confirm the vulnerability.


SECURITY AND SENSITIVE DATA

Invicti’s highly accurate approach to finding and confirming vulnerabilities
means that we are able to confidently confirm vulnerabilities. However, while
using this approach, none of our servers log any sensitive data about
vulnerabilities or about the target web application.

Tweet
Share
Share

--------------------------------------------------------------------------------

CONTACT SUPPORT

OPEN A TICKET


TOP ARTICLES

 * What is Invicti?
 * Overview of Scan Policies
 * Scheduling Scans
 * Managing Integrations
 * Built-In Reports


CATEGORIES

 * Getting Started
 * Your Account
 * Settings
 * Scans
 * Issues
 * Notifications
 * Integrations
 * Reports
 * Team Management

Highly accurate, fast & easy-to-use Web Application Security Scanner

Get a demo
X



Invicti Security Corp
220 Industrial Blvd Ste 102
Austin, TX 78745

© Invicti 2022

RESOURCES

 * Features
 * Integrations
 * Pricing
 * Case Studies
 * Advisories
 * White Papers

USE CASES

 * Penetration Testing Software
 * Website Security Scanner
 * Ethical Hacking Software
 * Web Vulnerability Scanner
 * Comparisons
 * Online Application Scanner

WEB SECURITY

 * The Problem with False Positives
 * Why Pay for Web Scanners
 * SQL Injection Cheat Sheet
 * Getting Started with Web Security
 * Vulnerability Index
 * Using Content Security Policy to Secure Web Applications

COMPANY

 * About Us
 * Contact Us
 * Support
 * Careers
 * Resources
 * Partners

© Invicti 2022

SSA Privacy Policy California Privacy Rights Terms of Use Accessibility Sitemap
By using this website you agree with our use of cookies to improve its
performance and enhance your experience. More information in our Privacy Policy.
OK

Feedback