docs: add safety considerations to internal scanning - #237
Open
patrick-projectdiscovery wants to merge 1 commit into
Open
docs: add safety considerations to internal scanning#237patrick-projectdiscovery wants to merge 1 commit into
patrick-projectdiscovery wants to merge 1 commit into
Conversation
Internal ranges contain printers, MFPs, PLCs, VoIP phones, and other embedded devices. Nuclei checks that reach printers over raw print protocols, IPP, or SNMP can print pages or hang the print controller rather than return a silent detection. Adds a Safety Considerations section covering printers, OT/ICS, VoIP and end-of-life hardware, Active Directory lockout, and connection-table exhaustion on appliances, with how to exclude each through Scan Exclusions or nuclei template flags. Links to it from the two places templates get selected. Neo's docs already carry this guidance in use-cases/internal-network-pentest.mdx. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The internal scanning page explains how to point pd-agent at an internal range but says nothing about what is sitting on those ranges. Nuclei ships checks that reach printers and MFPs over port
9100, IPP, and SNMP, and on live hardware those can print pages or hang the print controller instead of returning a silent detection.Adds a
Safety Considerationssection covering printers and MFPs, OT/ICS and building systems, VoIP and end-of-life hardware, Active Directory lockout, and connection-table exhaustion on network appliances. Each category says how to scope it out: Scan Exclusions for agent based scanning,-itagsand-exclude-templatesfor the local scanning and upload path.Neo's docs have carried this guidance since neo-docs #27 (
use-cases/internal-network-pentest.mdx). This ports it to Cloud, where the same templates run against the same hardware.Linked from the two points where templates get selected: Method 1 step 4, and after the Method 2 examples.
The matching pointer in the agent's own install guide is projectdiscovery/pd-agent#164.