Forum Discussion

RockBD's avatar
RockBD
Icon for Altocumulus rankAltocumulus
Nov 10, 2024

VAPT or APT tools scan prevention

Hello  When the security team starts Vulnerability Assessment and Penetration Testing (VAPT) or Application Security Testing (APT) on a web application, then it can go and test those web pages tha...
application delivery
security
MoFaz's avatar
MoFaz
Icon for Moderator rankModerator
Nov 11, 2024

Hey RockBD ,

Thanks for your response. Can I clarify that you want to block VAPT scans from scanning browsers that your registered users can access to? 

 

  • RockBD's avatar
    RockBD
    Icon for Altocumulus rankAltocumulus
    Nov 11, 2024

    I want to block unregistered user access from outside world to my web systems. outside access can be VAPT scans or other for unregister users.

    • boneyard's avatar
      boneyard
      Icon for MVP rankMVP
      Nov 18, 2024

      how you do make a difference between unregistered and registered users?

    • zamroni777's avatar
      zamroni777
      Icon for Nacreous rankNacreous
      Nov 19, 2024

      in that case, you can try adding APM access profile's authentication page to the LTM vserver.
      it's not tunnel mode so shouldnt need apm ccu license.

      i implemented such mechanism using other ADC brand for a corporate banking website.

      surely vapt can still access that webpage but bigip wont forward unauthenticated requests to backend ltm pool members.