Step 2: Installing and configuring the web app server and AV service

This document is for:

Invicti Enterprise On-Premises

Installing the Invicti Enterprise Application Server

The Invicti Enterprise Application Server is installed using a wizard. The wizard has two parts:

The Invicti Enterprise Web Application
The Authentication Verifier Service

NOTE: The Authentication Verifier Service is an optional part of this installation process. You can install the Authentication Verifier Service whenever you want. For more information about installing the verifier service, refer to Authentication Verifier Settings.

The following instructions explain how to install the Web Application and Verifier Service at the same time.

How to install the Invicti Enterprise Application Server and Authentication Verifier Service

Run the WebAppSetup.exe file and select Next.
On the End-User License Agreement step, accept the license agreement, and select Next.

On the Ready to Install step, select Install to install the Web Application Server, and wait for a while.

The installation asks you to install the prerequisite: The Authentication Verifier Service.
On the Welcome to the Prerequisites Setup Wizard window, select Next to continue.

On the Select Installation Folder step, select Next to install the Authentication Verifier Service to the default folder. Or select Browse to select an installation folder. Select Next.

On the Completing the Invicti Enterprise Authentication Verifier Service Setup Wizard step, select Finish to complete the installation.

On the Completing the Invicti Enterprise Web Application Setup Wizard step, select Finish to complete the Web Application Setup process.

Next steps:

Configuring the Invicti Enterprise Web Application Server using the Installation Wizard

From the server URL on which the Invicti Enterprise application is installed, you need to run the Invicti Enterprise Installation Wizard to complete the installation.

TIP: You can also install the Invicti Enterprise Web Application in silent mode. For more information, refer to Installing Invicti Enterprise On-Premises in Silent Mode.

How to configure the Invicti Enterprise Web Application Server using the installation wizard

The first step of the Installation Wizard is to configure the database connection.
Complete the fields to enable Invicti to build the necessary database structure and populate it with data. Then, click Next.
On the Encryption page, select Download the Secret Key to download your key. Then, click Next.

On the License page, select Import a License (.nsc file) and import your license file. Then, click Next.
On the Account page, complete the fields to set up your account administrator account. Then, click Next.
On the General page, the fields in the General step are already populated with some default values. You can change them as required. Then, click Next.
On the Cloud page, if you use cloud providers like Amazon AWS, you can configure the settings in this step (refer to Cloud Provider Settings). If you don't use a cloud provider, deselect the Cloud Integration checkbox. Then, click Next.

On the Scanner Agent Settings page, copy the Access Token if you want to install the scanner agents following the installation wizard process. These agents will be used to scan target applications.

It is possible to skip this step by selecting the Continue without installing an agent checkbox.

You can install agents whenever you want. If you want to install an agent at this step, execute the file AgentSetup.exe from the zip file. (For more information on agents, refer to Agents in Invicti Enterprise On-Premises). Select Next.

On the Authentication Verifier Settings page, copy the Access Token if you want to install the authentication verifier agents following the installation wizard process. Then, click Next.

TIP: The Authentication Verifier is one of the five components of Invicti Enterprise that is used to verify Form Authentication settings. It is an optional component. For more information, refer to Authentication Verifier Settings.

If the websites you are scanning do not use form authentication, you do not need this component.

It is also possible to skip this step and set it up later in Invicti Enterprise. Refer to the Installing Invicti Enterprise Authentication Verifier section of this article.

On the Email and SMS pages, configure SMS and email notifications to inform users instantly about the status of a web application security scan, or when specific vulnerabilities are identified on the web applications you are scanning. For further information, refer to Managing Notifications.

NOTE: To send invitations to new users or other email notifications, you need to configure SMTP settings. You also need to have a Twilio account to be able to receive SMS notifications.

It is possible to skip this step and the next step by deselecting the Enable Email Notifications and Enable SMS Notification checkboxes.

Select Finish to complete the installation wizard.

Configuring a proxy for the Invicti Enterprise Web Application

You may need to configure a proxy for the Invicti Enterprise Web Application. For information about setting a proxy for the agent, refer to Setting Proxy in Scanner Agents.

IMPORTANT: This instruction assumes that you installed Invicti Enterprise On-Premises to the default location, which is C:\Program Files (x86). If not, please change the relevant step in the instructions accordingly.

How to configure a proxy for the Invicti Enterprise Web Application

Press the Windows key + E.
Paste the following file path into the address bar: C:\Program Files (x86)\Invicti Enterprise Web Application.
Open Web.config with a text editor and locate the proxy configuration line.

<system.net>

<!--<defaultProxy>

</defaultProxy>-->

</system.net>

Remove the comment characters from the proxy configuration line.
Enter your proxy configuration.
Save and close the Web.config file.
Restart the IIS for changes to take effect.

TIP: In addition to the proxy address, you can also add information such as a bypass list to the proxy configuration. It looks like the following:

<system.net>

<proxy proxyaddress="http://127.0.0.1:8080"

bypassonlocal="True"/>

</bypasslist>

</defaultProxy>

</system.net>

How to change the installation folder for the Invicti Enterprise Web Application

The installer does not provide an option to select the folder location, however, you can change the location once the installation is complete. To do this, follow these steps:

Copy the installation folder (C:\Program Files (x86)\Invicti Enterprise Web Application) to the target disk.
Open IIS.
From Sites, select NetsparkerCloud.
Select Advanced Settings.
Replace the physical path with the new path.

Configuring notification settings

In the Invicti Enterprise Application Server security scanner, you can configure SMS and email notifications to inform users instantly about the status of a web application security scan or when specific vulnerabilities are identified on the web applications you are scanning.