In case of an automated security scan is it more desirable to get the scanner IP addresses whitelisted in order to possibly find vulnerabilities behind the firewall, or to scan in front of/against the firewall?
- webserver 1
- webserver 2
- database server
- log/monitoring server
Let's assume the website or web application is only accessible over port 80 (HTTP) and port 443 (HTTPS). All other ports are filtered by the firewall except one extra open port for a (management) VPN connection. All the traffic is going from firewall to loadbalancer, to webserver (using database- and storageserver). The log/monitoring server is stand-alone.
On one side I could argue that scanning behind a firewall (with IP whitelisting) is more desirable because you could possibly get insight in more vulnerabilities and mitigate those, even while it's unlikely they can be exploited.
On the other side, I could argue not to whitelist the scanner IP addresses because this scenario is more realistic (blackbox) and wouldn't give the advantage of scanning areas that are filtered from the world wide web in the first place.
Nobody can access the database server or monitoring server directly but if those machines are for example using "123456" as a root password or missing 100+ OS patches making them vulnerable to a load of CVE's. You'd like to get to know that I suppose.
What is the desirable solution/scope here and what is best to advice someone about this? Does the IP whitelisting introduce a higher responsibility for me as an ethical hacker? Since the customer is introducing a weak point in their security by whitelisting the scanner IP addresses.