@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
mdx 122 lines 3.42 KB
Raw
1 ---
2 title: Web vulnerability assessment (Nuclei)
3 description: Run Nuclei-based web vulnerability scans inside CoPilot and review findings with request/response detail.
4 ---
5
6 CoPilot includes a web vulnerability scanning module powered by **Nuclei**.
7
8 It’s designed to give operators/admins a fast way to validate web exposure and identify common web/app misconfigurations across owned/authorized targets.
9
10 ---
11
12 ## Why this is a power feature
13
14 Web scanning is not required for initial SIEM bring-up, but it’s a high-leverage add-on for reducing attack surface.
15
16 Use it for:
17 - periodic external exposure reviews (what are we accidentally exposing?)
18 - validating suspected vulnerabilities during an incident
19 - confirming whether a customer-facing app has known weak configurations (TLS, headers, exposed endpoints)
20
21 ---
22
23 ## How it works in CoPilot (high level)
24
25 1) You enable the CoPilot Nuclei module
26 2) You submit a target host/domain (and any supported scan options)
27 3) CoPilot runs Nuclei in the background
28 4) Results are stored and displayed as a report
29 5) You can drill into each finding for evidence and reproduction detail
30
31 ---
32
33 ## Setup checklist
34
35 ### 1) Enable the Nuclei module (Docker)
36
37 In the video walkthrough, Nuclei is enabled by adding the **CoPilot Nuclei module container** to your CoPilot `docker-compose.yml`, then running a compose up.
38
39 Success check:
40 - the Nuclei module container is running
41 - the **Web vulnerability assessment** entry becomes available in the UI
42
43 ### 2) Confirm scanner reachability
44
45 The scanner runtime must be able to reach your targets.
46
47 Confirm:
48 - DNS resolution works from the scanner runtime
49 - egress is allowed to the target(s)
50 - you’re scoping to assets you own/have permission to scan
51
52 ---
53
54 ## Running a scan
55
56 Typical workflow (from the video):
57
58 1) Open **Web vulnerability assessment**
59 2) Select **Create new report** (if applicable)
60 3) Enter a target host/domain
61 - you usually don’t need to include `http://` or `https://` if the UI accepts a host
62 4) Submit
63 5) Wait for completion, then **refresh** the page
64
65 ---
66
67 ## Understanding results
68
69 Once results are available, you can typically:
70 - see a list of findings (grouped by type)
71 - open a finding to review details
72
73 Per-finding detail often includes:
74 - description of what was detected
75 - affected URL
76 - the HTTP request/response evidence
77 - the **curl command** Nuclei used (useful for reproduction and follow-up testing)
78
79 This makes it easy to:
80 - validate the finding
81 - hand evidence to an app owner
82 - reproduce safely in a test environment
83
84 ---
85
86 ## Practical operator usage
87
88 A good operator loop:
89
90 1) Run a scan against a specific application
91 2) Identify quick wins (weak TLS/ciphers, exposed Swagger/OpenAPI, debug endpoints)
92 3) Create remediation tasks and validate closure by rescanning
93
94 ---
95
96 ## Safety / guardrails
97
98 - Only scan assets you **own** or have **explicit permission** to test.
99 - Scanning can trigger WAF blocks, rate limits, or availability impact.
100 - start with a single target
101 - schedule scans during a quiet window
102 - avoid aggressive configurations by default
103
104 ---
105
106 ## Troubleshooting
107
108 - No results / scan never completes:
109 - confirm the Nuclei module container is running
110 - confirm the scanner can reach the target host
111 - check CoPilot/Nuclei module logs
112
113 - False positives:
114 - use the request/response + curl output to validate
115 - tune templates/scan scope as needed
116
117 ---
118
119 ## Video context
120
121 Enablement + walkthrough:
122 - https://www.youtube.com/watch?v=-SVHKuQUxlI