Skip to content
Prepare my pentest

Launch an internal scan

Create an internal application attached to a site whose agent is ready and whose mandate is current, prepare and launch the pentest, follow the scan, handle a relay disconnection and receive the report.

How-to guide · Customers1 min read

Markdown versionOpen in ChatGPTOpen in Claude

Prerequisites#

  • Internal scans enabled by SpectrAI on your space.
  • A site with at least one ready agent (connected within the last 90 seconds).
  • A current mandate covering the application to test.
  • An available evaluation.

Launching#

  1. In Targets, add a target and choose Internal application (via agent), then the site. The URL must be covered by the site's mandate (host, optional subdomains, ports).
  2. Write and publish its Guidance (see Write the Guidance).
  3. In Pentests, prepare the pentest on this target. The chosen URLs are the starting points; an internal application pentest contains only URLs of the same site, covered by its authorisation.
  4. Provide test accounts if needed, accept the authorisation attestation and launch.

The launch checks that the agent is ready and that the mandate covers the URLs. An available evaluation is deducted.

During the scan#

The pentest page shows the phases, the duration, the latest end time, the surfaces tested and the last activity, as for an external pentest (see Follow the activity). Keep the agent connected.

If the relay disconnects#

  • The pentest stops and results already collected are kept.
  • Restore the agent (machine, container, outbound network), then choose Resume the pentest.
  • The resume creates a new attempt on the same mission; losing the relay does not return the evaluation.

The report#

At the end, the evidence, scope and consistency checks run and the report is published automatically, exportable as PDF. Findings and attack paths can be read in the application. See The report.

Retests and additional URLs#

As for an external pentest, two retest batches are included within sixty days of the report. Destinations discovered within the mandate may also be offered for a targeted test within that window (see The testing mandate).