Skip to main content
Please sign-in to start using Help Center features

Fortify ScanCentral DAST: How to Scan Customer Private Applications

Maurizio Di Stefano
  • Updated

An OpenText Fortify ScanCentral DAST (SC DAST) scan of customer private sites can be achieved by using one of the following options:

  1. Whitelist the Fortify Hosted SC DAST sensor(s) source IP Address(es) provided by Ops
     
  2. Locally hosted Fortify DAST Scan Sensor deployed in one of the following ways:

    1. Kubernetes Helm Charts

      Installed and managed by customer or Professional Services.

      The following document describes how to configure and use the scancentral-dast-scanner 24.4 Helm charts for complete ScanCentral DAST scanner container orchestration in Kubernetes. Deploying DAST Scanner in Kubernetes

      Tips and clarifications:

      1. The ScanCentral DAST core components have been already installed and are part of Fortify Hosted.
      2. The core configuration properties values (DAST API service URL and DAST API service token secret) are received on sign-up within a password protected document).

      3. The ScanCentral DAST Scanner Helm charts version should match the Fortify product version deployed in Fortify Hosted. Anything other than major/minor is essentially patches. Always get the latest patches. Tip: To find other available versions, go to https://hub.docker.com/r/fortifydocker/helm-scancentral-dast-scanner/tags. 

         

    2. Docker Compose Scripts (this is for 26.2+)

      Installed and managed by customer or Professional Services.

      1. Download the Docker Compose scripts from the Fortify Hosted Support Hub -- docker-compose-scannerservice-<ver>-FortifyHosted.zip. 

      2. Unzip the file.

      3. Choose the appropriate script based on whether you plan to use Microsoft SQL Express or PostgreSQL.

      4. Refer to Using the TLS compose file for the sensor

      5. Edit the .env according to the Configuring the TLS environment file for the scanner service. 

        • The "SCDAST_API_ROOT_URL" and" SCDAST_SERVICE_TOKEN" values are provided by the Fortify Hosted team as "Fortify ScanCentral SC DAST API URL" and scDastServiceToken" respectively.

        • The SCDAST_API_ROOT_URL needs to be accessible by the sensor container.
           

  3. Fortify Connect (FC)

    Installed and managed by customer or Professional Services.

    FC is a point-to-point non-routed proxy tunnel created without the need to expose the target application through your firewall. This is not a viable option for customers connecting to Fortify Hosted via VPN. 

    Cloud/Remote Mode

    1. The diagram included below depicts a DAST/WebInspect Sensor Running in the cloud based Fortify Hosted environment (aka Cloud/Remote Mode). This assumes you have internal applications which need to be scanned, but the internal applications are not accessible from outside your internal network. 
      The FC Client is a pre-configured executable that runs behind your firewall; establishes a point-to-point proxy tunnel that enables the Fortify ScanCentral DAST scanner to leverage the Fortify Connect Server (running in the cloud) and Client (running in your internal network) as a proxy to your internal sites. No other traffic can be routed over this connection.
      • The pre-configured FC Client executable will be available for download via the “ScanCentral DAST > Fortify Connect” configuration tab after you configure FC in your Fortify Hosted environment.
    2. Working with Fortify Connect for private application scanning
    3. Fortify Connect Client on Fortify ScanCentral DAST
      1. Note: Fortify Connect Client is only officially supported on Linux
    4. Configuring and using Fortify Connect
      1. Note: only from step 2 to step 8

 

Related articles