Network Pentests
Set up a network pentest of the public hosts and services under your root domains.
Pick Network to pentest public-facing hosts and services. Aikido discovers the subdomains of the root domains you add, scans what is reachable from the internet, and confirms exposed services, known-vulnerable versions, and default credentials.
This assessment tests hosts that are reachable from the public internet. To thoroughly test an application, including the application logic, authorization and authentication layers, use a Web Application pentest.
When to use what
| Option | Use it when |
|---|---|
| Network | You want a pentest of public infrastructure under one or more root domains: exposed services, vulnerable software versions, and default credentials. |
| Web Application | You want a pentest of a website, frontend, or API, including application logic. Aikido also checks the host behind each in-scope URL. See How to Setup a Pentest. |
| Attack Surface Monitoring | You want ongoing discovery of internet-facing assets, such as forgotten subdomains and dangling DNS. It does not produce a pentest report. See Attack Surface Monitoring. |
How it works
After you start the assessment, Aikido runs an attack surface scan of the root domains, then tests each subdomain that has services reachable from the internet. While that scan is in progress, the assessment shows Running attack surface scan.
Aikido confirms:
- Vulnerable software versions on web servers, application servers, and platforms, such as nginx, Apache, Tomcat, WordPress, and Grafana. The version is confirmed from the service itself.
- Exposed admin, status, and debug surfaces that leak sensitive information.
- Default or weak credentials documented for that service, plus a small set of obvious variants such as an unchanged vendor login. Checks stay limited to those guesses.
- Exposed network services such as SSH, SMB, FTP, PostgreSQL, and Redis/Valkey, checked for missing authentication, default credentials, and known-vulnerable versions.
Each confirmed finding includes evidence and remediation. The run includes a compliance-ready report and retesting.
Application logic, including SQL injection, cross-site scripting, and broken access control, is covered by a Web Application pentest.
Agents only reach the hosts and ports in scope. See Safety Measures.
The price is 20 credits per subdomain you keep in the list. You can add up to 5 root domains and keep up to 1,000 subdomains. The coverage slider used by other Rightsized Pentests does not apply. Run now, pay later is not available. See Pentest Pricing.
Prerequisites
- Manage Pentests permission
- Sufficient credits in your wallet
- One or more root domains you own, such as
example.com. Enter the root domain, not a hostname such asapi.example.com. - A way to verify domain ownership before launch
Set up a network pentest
Select Network
Go to Pentests, open your Project, and click Create Assessment. On Select Pentest Target, select Network.
Add root domains
On Define Test Scope, enter a root domain, for example
example.com. Click Add Domain for each additional root domain, up to 5.If the root domain is not already in Attack Surface Monitoring, Aikido adds it there. Click Continue. Aikido starts subdomain discovery, which usually takes a few minutes.
Review discovered subdomains
This step is Allowed Domains in the sidebar. The page title is Review Discovered Subdomains. Aikido lists the subdomains it found. Hostnames without an IP address, and hostnames excluded in Attack Surface Monitoring, are left out.
Remove any hostname you do not want tested. Aikido only tests the hostnames still in the list. Keep at least 1, and at most 1,000. Click Continue.
Set the request rate and schedule
On Configure Safety Settings, set Maximum requests per second and the Pentest schedule. The default schedule is Start immediately. You can also limit testing to business hours, outside business hours, or the weekend.
This assessment has no Test Users step and no Code & Documentation step.
Confirm the credit cost
On Select Pentest Depth, the only option is Rightsized Test. The cost is 20 credits for each subdomain still in scope, and it includes a compliance-ready report and retesting. Click Continue.
Verify ownership and launch
On Review Summary, check the hostnames under Attackable Domains and the credit total.
Aikido checks ownership of each root domain. If a domain is not verified yet, click Verify and complete domain verification. Aikido skips this when the domain was verified before, or when you are signed in with Google or Microsoft and your email address is on that domain.
Click Run Assessment.
Troubleshooting
Aikido says the hostname is a subdomain. Enter the root domain. For api.example.com, add example.com. Aikido discovers api.example.com in the next step.
Subdomain discovery failed. The page tells you to go back. Click Back, then Continue, to start discovery again.
No subdomains found. Aikido found no hostnames with an IP address that are still included in Attack Surface Monitoring. Check that the root domain is correct, and that the hosts you care about are not excluded there.
Continue stays disabled. The list needs at least 1 subdomain. If you have more than 1,000, remove hostnames until the list is within the limit.
The assessment fails during the attack surface scan. Aikido marks the assessment failed and refunds the credits. Start the assessment again after you confirm the root domain still resolves.