> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/pentests/configure-a-pentest/external-network-pentesting.md).

# Pentesting External Networks

Set up an External Network pentest of the public hosts and services under your root domains.

Pick **External Network** to pentest public-facing hosts and services. Aikido discovers the subdomains of the root domains you add, scans what is reachable from the internet, and confirms exposed services, known-vulnerable versions, and default credentials.

This assessment tests hosts that are reachable from the public internet. To thoroughly test an application, including the application logic, authorization and authentication layers, use a **Web Applicatio**n pentest.

## When to use what

| Option                        | Use it when                                                                                                                                                                                                                      |
| ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **External Network**          | You want a pentest of public infrastructure under one or more root domains: exposed services, vulnerable software versions, and default credentials.                                                                             |
| **Web Application**           | You want a pentest of a website, frontend, or API, including application logic. Aikido also checks the host behind each in-scope URL. See [How to Setup a Pentest](/pentests/configure-a-pentest/starting-an-assessment.md).     |
| **Attack Surface Monitoring** | You want ongoing discovery of internet-facing assets, such as forgotten subdomains and dangling DNS. It does not produce a pentest report. See [Attack Surface Monitoring](/dast-surface-monitoring/attack-surface-scanning.md). |

## How it works

After you start the assessment, Aikido runs an attack surface scan of the root domains, then tests each subdomain that has services reachable from the internet. While that scan is in progress, the assessment shows **Running attack surface scan**.

Aikido confirms:

* **Vulnerable software versions** on web servers, application servers, and platforms, such as nginx, Apache, Tomcat, WordPress, and Grafana. The version is confirmed from the service itself.
* **Exposed admin, status, and debug surfaces** that leak sensitive information.
* **Default or weak credentials** documented for that service, plus a small set of obvious variants such as an unchanged vendor login. Checks stay limited to those guesses.
* **Exposed network services** such as SSH, SMB, FTP, PostgreSQL, and Redis/Valkey, checked for missing authentication, default credentials, and known-vulnerable versions.

Each confirmed finding includes evidence and remediation. The run includes a compliance-ready report and [retesting](/pentests/coverage-and-findings/retest-pentest-findings.md).

Application logic, including SQL injection, cross-site scripting, and broken access control, is covered by a **Web Application** pentest.

Agents only reach the hosts and ports in scope. See [Safety Measures](/pentests/configure-a-pentest/safety-measures.md).

The price is **20 credits per subdomain** you keep in the list. You can add up to 5 root domains and keep up to 1,000 subdomains. The coverage slider used by other Rightsized Pentests does not apply. [Run now, pay later](/pentests/pentest-pricing.md#run-now-pay-later) is not available. See [Pentest Pricing](/pentests/pentest-pricing.md).

## Prerequisites

* **Manage Pentests** [permission](/getting-started/automated-user-management/setting-roles-and-permissions.md)
* **Sufficient credits** in your [wallet](/miscellaneous-info/wallet-and-credits.md)
* One or more **root domains** you own, such as `example.com`. Enter the root domain, not a hostname such as `api.example.com`.
* A way to [verify domain ownership](/pentests/configure-a-pentest/domain-verification.md) before launch

## Set up an external network pentest

{% stepper %}
{% step %}

### Select External Network

Go to **Pentests**, open your **Project**, and click **Create Assessment**. On **Select Pentest Target**, select **External Network**.
{% endstep %}

{% step %}

### Add root domains

On **Define Test Scope**, enter a root domain, for example `example.com`. Click **Add Domain** for each additional root domain, up to 5.

If the root domain is not already in Attack Surface Monitoring, Aikido adds it there. Click **Continue**. Aikido starts subdomain discovery, which usually takes a few minutes.
{% endstep %}

{% step %}

### Review discovered subdomains

This step is **Allowed Domains** in the sidebar. The page title is **Review Discovered Subdomains**. Aikido lists the subdomains it found. Hostnames without an IP address, and hostnames excluded in Attack Surface Monitoring, are left out.

Remove any hostname you do not want tested. Aikido only tests the hostnames still in the list. Keep at least 1, and at most 1,000. Click **Continue**.
{% endstep %}

{% step %}

### Set the request rate and schedule

On **Configure Safety Settings**, set **Maximum requests per second** and the **Pentest schedule**. The default schedule is **Start immediately**. You can also limit testing to business hours, outside business hours, or the weekend.

This assessment has no **Test Users** step and no **Code & Documentation** step.
{% endstep %}

{% step %}

### Confirm the credit cost

On **Select Pentest Depth**, the only option is **Rightsized Test**. The cost is 20 credits for each subdomain still in scope, and it includes a compliance-ready report and retesting. Click **Continue**.
{% endstep %}

{% step %}

### Verify ownership and launch

On **Review Summary**, check the hostnames under **Attackable Domains** and the credit total.

Aikido checks ownership of each root domain. If a domain is not verified yet, click **Verify** and complete [domain verification](/pentests/configure-a-pentest/domain-verification.md). Aikido skips this when the domain was verified before, or when you are signed in with Google or Microsoft and your email address is on that domain.

Click **Run Assessment**.
{% endstep %}
{% endstepper %}

## Troubleshooting

**Aikido says the hostname is a subdomain.** Enter the root domain. For `api.example.com`, add `example.com`. Aikido discovers `api.example.com` in the next step.

**Subdomain discovery failed.** The page tells you to go back. Click **Back**, then **Continue**, to start discovery again.

**No subdomains found.** Aikido found no hostnames with an IP address that are still included in Attack Surface Monitoring. Check that the root domain is correct, and that the hosts you care about are not excluded there.

**Continue stays disabled.** The list needs at least 1 subdomain. If you have more than 1,000, remove hostnames until the list is within the limit.

**The assessment fails during the attack surface scan.** Aikido marks the assessment failed and refunds the credits. Start the assessment again after you confirm the root domain still resolves.

## Related

{% content-ref url="/pages/hCQQM8nd9Zl8tsJuMP5g" %}
[Pentest Pricing](/pentests/pentest-pricing.md)
{% endcontent-ref %}

{% content-ref url="/pages/1cQCJUMOpGbuPvKh3f9s" %}
[Domain Verification](/pentests/configure-a-pentest/domain-verification.md)
{% endcontent-ref %}

{% content-ref url="/pages/Auvhi5ng7vUGt7idisgL" %}
[IP Addresses for Pentest](/pentests/prepare-a-pentest/ip-addresses-for-pentest.md)
{% endcontent-ref %}

{% content-ref url="/pages/mwtaaYJn0IjsQ1mLsAct" %}
[Attack Surface Monitoring](/dast-surface-monitoring/attack-surface-scanning.md)
{% endcontent-ref %}

{% content-ref url="/pages/Kut5ITWbPPLUWhZKrvX8" %}
[Pentest Reports](/pentests/coverage-and-findings/pentest-reports.md)
{% endcontent-ref %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.aikido.dev/pentests/configure-a-pentest/external-network-pentesting.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.