Private Networks

Overview

Need to keep pentester activity inside your own network boundary? Run the engagement from within your own environment using the Nullify CLI. The CLI executes the DAST agent locally — pointed at internal hosts that only your network can reach — and streams results back to your hosted tenant, so the traffic never leaves your boundary.

This applies to pentests only. Exploit validation requires a target reachable from the internet and has no private-network equivalent.

Orchestration Options

• CLI — The Nullify CLI launches pentests from inside your network and reports results to the platform. Pass the --local flag to nullify pentest to run the scan locally: the CLI executes the agent inside the Nullify DAST image (ghcr.io/nullify-platform/dast) it pulls on first use, pointed at internal hosts only your network can reach. Use --image-label to pin a specific tag, --force-pull to always pull the latest, and --use-host-network when the target is only reachable on the host network.

• Continuous integration — Run the same --local command on a self-hosted runner that sits inside your network, so private engagements execute as part of a release workflow. See Engagement Workflow for authentication in CI.

Contact support for IAM policies and sizing recommendations tailored to your environment.

AWS PrivateLink

For customers who need pentest traffic to stay on a private network, Nullify supports connectivity via AWS PrivateLink. Instead of routing traffic over the public internet, Nullify connects to your applications through a VPC endpoint, keeping all communication within the AWS backbone.

Prerequisites

• A VPC Endpoint Service in your AWS account. AWS PrivateLink supports endpoint services backed by a Network Load Balancer (NLB), Gateway Load Balancer (GWLB), or directly by an application running on supported compute (e.g. ECS, EKS, EC2).

• The endpoint service must be in an Available state.

• Your target applications accessible on the required ports from within the VPC.

Setup Steps

1. Create a VPC Endpoint Service

If you haven't already, create an endpoint service in the AWS Console or CLI that routes to your pentest target applications. See the AWS documentation for supported configurations.

2. Share the service details with Nullify

Provide the Nullify team with:

• Your VPC Endpoint Service name (e.g. com.amazonaws.vpce.<region>.vpce-svc-<id>).

• The region the service is deployed in.

• The ports your applications listen on.

3. Whitelist the Nullify AWS account

Add the Nullify account as an allowed principal so we can create an interface endpoint to your service. The Nullify team will provide the account ID.

aws ec2 modify-vpc-endpoint-service-permissions \
  --service-id <your-service-id> \
  --add-allowed-principals arn:aws:iam::<nullify-account-id>:root \
  --region <region>

4. Accept the VPC endpoint connection

Once Nullify creates the interface endpoint, accept the pending connection request. You can do this in the AWS Console under VPC → Endpoint Services → Endpoint Connections, or via the CLI:

aws ec2 accept-vpc-endpoint-connections \
  --service-id <your-service-id> \
  --vpc-endpoint-ids <endpoint-id> \
  --region <region>

5. Update security groups

Ensure the security group attached to your target applications allows inbound traffic from the Nullify VPC CIDR range on the required ports. The Nullify team will provide the CIDR range to whitelist.

Note: A self-referencing security group rule (one that only allows traffic from itself) will not permit traffic arriving through the VPC endpoint interface. You must add an explicit inbound rule for the Nullify CIDR range.

6. Verify connectivity

The Nullify team will confirm connectivity to your applications over the private link. Once verified, the pentest can begin.

Troubleshooting

• InvalidServiceName error — Confirm the endpoint service region matches and that the Nullify account has been added to the allowed principals.

• Connection timeouts — Ensure your security group allows inbound traffic from the Nullify VPC CIDR range on the required ports.

• Endpoint state not Available — Verify the endpoint service is active and the underlying Network Load Balancer targets are healthy.

For assistance with PrivateLink setup, contact the Nullify team at [e-mail].