The relay
How the internal scan relay works: an agent installed on your side, a signed image, a mandate enforced at the network level and destinations outside the mandate never tested.
The problem#
Part of your applications is not exposed on the Internet: intranet, business tools, administration consoles, machine-to-machine services. An external pentest does not reach them. The relay lets you test them from inside your network, with the same engine, the same evidence and the same report.
The parts#
| Part | Role |
|---|---|
| Site | An internal network you declare in Sites and agents, with 1 to 16 private IPv4 ranges (CIDR within 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 or 100.64.0.0/10). Declaring them does not authorise scanning them. IPv6 is disabled. |
| Agent | A Docker container installed on a machine of the site. It opens no port: it connects only towards SpectrAI, over outbound HTTPS, directly or through the company proxy. |
| Mandate | The testing authorisation of one application through this site: hostname, subdomains included or not, HTTPS ports, validity period, revision signed by a member of your team. |
| Egress relay | The SpectrAI-side component that enforces the mandate: only authorised destinations are relayed. |
The trust model#
- The agent image is signed and distributed from
relay.spectr-ai.eu. The installer checks its digest and signature before starting the agent. - An agent is ready when it has connected to SpectrAI within the last 90 seconds. Without a ready agent, no test goes through the site.
- The mandate is a network policy, enforced by the egress relay with DNS resolutions and addresses bounded per site. It does not rely on an instruction given to the test agents.
- Only the application of the mandate is tested. A destination outside the mandate discovered during the test becomes a suggestion to approve, never a test.
- The mandate has an end date. Without a current authorisation, no test can be launched on the site. It can also be revoked at any time.
What the agent sees#
The agent relays HTTP(S) traffic to the destinations of the mandate. The test accounts provided for the scan travel, during the run, in clear text through the test engine and the model that drives it, as for an external pentest: use dedicated, revocable accounts.
Availability during the test#
The relay must stay available for the whole duration of the test: machine on, container running, outbound connection to SpectrAI. If the agent disconnects:
- results already collected are kept;
- the pentest stops and offers an explicit resume once the agent is back;
- losing the relay does not return the evaluation: the relaunch is covered.
What is not covered#
- An internal scan targets the web application named in the mandate; it does not cover a sweep of the declared ranges, bare IP addresses or non-web protocols.
- The scope of an internal scan is its mandate, not "the whole network".
See also Install the relay and The testing mandate.