Skip to content

Create a Scope (Asset Group)

To run an external pentest, first create a Scope (called an Asset Group in earlier NodeZero Versions). This will define the scope for asset discovery and the external pentest.

From the NodeZero Portal's top navigation, select External Assets.

Configure the Scope

Unless you want to define your Scope by bulk-uploading assets, kick off UI-guided configuration of your Scope by clicking the Run External Asset Discovery button.

The "External Assets" link is in the UI's top-level navigation. Below this are a "Scopes" default lower tab, and a "Run External Asset Discovery" button.

From the resulting modal shown below, click the + button to the right of Create New Scope.

The Run External Asset Discovery modal provides "Create New Scope" and "Run with Existing Scope" buttons.

In the resulting Run External Asset Discovery modal, use the following steps to define a Scope.

Set Scope's Name and Inputs

Name the Scope and define its inputs (your organization's assets). You can specify registered domains and associated IP addresses to include, and can also specify IPs and subnets to exclude.

IPs must be public, must be formatted using IP/CIDR notation, and must be comma-separated in each list. Please specify network segments of /16 or smaller (e.g., /18, /23, /24). See also Add IP Ranges below.

Optionally, toggle on Auto-Authorize Discovered Assets.

"Run External Asset Discovery" modal's top half, providing "Name Your Scope" field and a "Scope Input" section that includes three panels for company registered domains, company associated IP addresses, and IPs/subnets to exclude.

Add AWS and Git Connections (Optional)

In the Connections section (shown below), you have the option to specify your organization's accounts on AWS, GitHub, GitLab, and/or Bitbucket. Listing these related accounts enables NodeZero to confirm ownership of these accounts, to perform a more thorough enumeration of assets.

Use the left Connection Type drop-down to select a vendor. Use the right Connection Value field to specify your corresponding account ID (e.g., a 12-digit AWS ID) or organization name. Click Add to insert each pair into the Scope's configuration.

"Run External Asset Discovery" modal's Connections section provides a drop-down with AWS, Bitbucket, GitLab,and GitHub options. To its right are a Connection Value field and an "Add" button.

Add OSINT Data

In the Public Data Enrichment section, you can add multiple names under which your organization is registered. Using these entries, NodeZero will apply Open Source Intelligence (OSINT) gathering tools and techniques to harvest additional related assets.

You can also specify IPs and subnets to exclude. As in Scope Inputs, both lists should be comma-separated.

Add Subdomain Discovery (Optional)

You can enable NodeZero's brute-force discovery of well-known subdomains that might not surface through OSINT discovery. You'll need to explicitly authorize these discovered subdomains for testing.

"Run External Asset Discovery" modal's middle section provides panels to enter Public Data Enrichment and a toggle to enable Subdomain Discovery (Brute Force).

Enable Schedule (Optional)

You can use the Discovery Schedule controls, shown below, to set a cron job that defines repeated discovery.

Once satisfied with all of the configuration options above, click Start Discovery.

"Run External Asset Discovery" modal's bottom "Discovery Schedule" section shows the "Enable Schedule" toggle switched on, revealing "Run Every" drop-downs (preset to "Week" and "5:00 PM"), buttons for days of the week, and "Ends: Never" radio buttons selected. Buttons on the bottom of the modal read "Back" and "Start Discovery."

Bulk Upload Assets

As an alternative to the guided configuration outlined above, you can define (or replace) a Scope by preparing and uploading a comma-separated CSV or text file that lists your assets.

Click Bulk Upload Assets to initiate this, and follow the resulting modal's instructions for formatting your file.

"Bulk Upload Assets" modal showing file-formatting instructions, "Create New Scope" and "Replace Existing Scope" buttons, a file drag-and-drop target panel, and Upload and Cancel buttons.

Add IP Ranges

You can use the IP Ranges tab to define groups of IPs to add to a Scope. Use the check boxes at left to select ranges, then click the Take Action menu's Add to Scope option. Next, you'll need to Run External Asset Discovery again.

The IP Ranges tab has a table with check boxes next to each domain, and a "Take Action" drop-down that applies to all selected ranges.