StackHawk

HawkScan is <a href="https://docs.stackhawk.com/hawkscan/configuration/" rel="nofollow noopener noreferrer" target="_blank">highly configurable</a>, accommodating multiple application types and their associated aspects such as authentication, path discovery (e.g., spidering), and API architecture.

If an application has an HTTP(S) endpoint, HawkScan can scan it, regardless of the underlying tech stack.

To that end, HawkScan requires that the <a href="https://docs.stackhawk.com/hawkscan/configuration/#app" rel="nofollow noopener noreferrer" target="_blank"><code>app</code></a><code>.host</code> field be configured in <code>stackhawk.yml </code>-- this represents the root URL of the application being scanned.

HawkScan allows the following options for URL's in <code>app.host</code>:

an FQDN in a URL (<code>https://app.company.com</code>)

an IP:PORT in a URL (<code>https://192.168.1.1:443</code>)

1. <code>https://localhost:5000</code>
2. <code>https://127.0.0.1:8000</code>

a domain as a URL (<code>https://domain.com</code>)

1. this approach is uncommon -- scans should be granular, localized, and non-production in nature (for instance, in a <a href="https://docs.stackhawk.com/continuous-integration/github-actions.html" rel="nofollow noopener noreferrer" target="_blank"><code>GitHub Actions</code></a> pipeline).

1. an FQDN in a URL (<code>https://app.company.com</code>)
2. an IP:PORT in a URL (<code>https://192.168.1.1:443</code>)
3. localhost as URL
   1. <code>https://localhost:5000</code>
   2. <code>https://127.0.0.1:8000</code>
4. a domain as a URL (<code>https://domain.com</code>)
   1. this approach is uncommon -- scans should be granular, localized, and non-production in nature (for instance, in a <a href="https://docs.stackhawk.com/continuous-integration/github-actions.html" rel="nofollow noopener noreferrer" target="_blank"><code>GitHub Actions</code></a> pipeline).

While the above examples use https, http (e.g., <code>http://localhost:5000</code>) is also an option within the URL

If not port is specified in the URL, the default http port (<code>80</code>) or https port (<code>443</code>) are assumed

- While the above examples use https, http (e.g., <code>http://localhost:5000</code>) is also an option within the URL
- If not port is specified in the URL, the default http port (<code>80</code>) or https port (<code>443</code>) are assumed

Specific paths (e.g., API paths such as <code>https://myapp.com/api/v2</code>) can be scanned, but can't serve as the root of the application to be scanned.

If you have applications for which communication with the root application url is not allowed (i.e., only specific paths respond to http messages, but the root does not), reach out to <a href="mailto:support@stackhawk.com" rel="nofollow noopener noreferrer" target="_blank">StackHawk Support</a> for assistance.

___________________________________________________________

Set app.host according to the rules above

Configure HawkScan to populate the paths beneath the application root, via:

1. <a href="https://docs.stackhawk.com/hawkscan/configuration/#hawkspider" rel="nofollow noopener noreferrer" target="_blank">hawk.spider</a> configuration
   1. standard spider (on by default)
   2. ajax spider (off by default)
   3. seedPaths
      1. manually enter app.spider.seedPaths entries to add additional starting points (relative to <code>app.host</code>) for crawling
         1. not for use for populating API Paths...see below
2. API configuration (to seed API paths to be scanned):
   1. <a href="https://docs.stackhawk.com/hawkscan/configuration/openapi-configuration.html" rel="nofollow noopener noreferrer" target="_blank">OpenAPI</a> (including Postman collections)
   2. <a href="https://docs.stackhawk.com/hawkscan/configuration/graphql-configuration.html" rel="nofollow noopener noreferrer" target="_blank">GraphQL</a>
3. set up <a href="https://docs.stackhawk.com/hawkscan/authenticated-scanning/" rel="nofollow noopener noreferrer" target="_blank">Authenticated scanning</a> as applicable

1. Set app.host according to the rules above
2. Configure HawkScan to populate the paths beneath the application root, via:
   1. <a href="https://docs.stackhawk.com/hawkscan/configuration/#hawkspider" rel="nofollow noopener noreferrer" target="_blank">hawk.spider</a> configuration
      1. standard spider (on by default)
      2. ajax spider (off by default)
      3. seedPaths
         1. manually enter app.spider.seedPaths entries to add additional starting points (relative to <code>app.host</code>) for crawling
            1. not for use for populating API Paths...see below
   2. API configuration (to seed API paths to be scanned):
      1. <a href="https://docs.stackhawk.com/hawkscan/configuration/openapi-configuration.html" rel="nofollow noopener noreferrer" target="_blank">OpenAPI</a> (including Postman collections)
      2. <a href="https://docs.stackhawk.com/hawkscan/configuration/graphql-configuration.html" rel="nofollow noopener noreferrer" target="_blank">GraphQL</a>
   3. set up <a href="https://docs.stackhawk.com/hawkscan/authenticated-scanning/" rel="nofollow noopener noreferrer" target="_blank">Authenticated scanning</a> as applicable
3. Run a scan
4. Repeat after me: "KaaKaww!"

Overview

What do we mean by root URL?

But what about paths?

Scanning Procedure