Question:
What hosts and ports does HawkScan need access to in order to run scans and gather scan data?
Answer:
HawkScan authenticates to the StackHawk platform and uploads scan data to signed S3 URLs on AWS. It also directly accesses the application being scanned.
Requirements Summary
Endpoint | Port |
auth.stackhawk.com | 443 |
api.stackhawk.com | 443 |
AWS S3 (IP range) | 443 |
Target Application | variable |
Detailed Requirements
auth.stackhawk.com
What is it?
HawkScan's authentication service
cnames to
auth.prod.stackhawk.com
How to access it?
build an FQDN rule in the firewall to allow access auth.stackhawk.com on TCP destination port 443
api.stackhawk.com
What is it?
HawkScan's api service
cnames to
api.prod.stackhawk.com
How to access it?
build an FQDN rule in the firewall to allow access api.stackhawk.com on TCP destination port 443
S3
What is it?
When HawkScan generates scan results, it uploads these to signed S3 URL's, where they become available at app.stackhack.com
How to access it?
Ensure that AWS' S3 IP address ranges are accessible from the system running HawkScan (Docker host, laptop running CLI)
Target Applications
What is it?
Applications being scanned by HawkScan
How to access it?
Docker-based scanning:
Make sure the docker host can reach the host and port of the application to be scanned
See these troubleshooting Resources if encountering issues here:
CLI-based scanning:
Make sure the system (e.g., laptop) that the CLI scanner is running from can reach the host and port of the application to be scanned