Create and manage Agentic BAS tasks - Security Center - Alibaba Cloud Documentation Center

Agentic BAS uses multi-agent collaboration to automatically simulate real attacks, continuously validates the effectiveness of your security system 24/7, and helps strengthen your security system and improve security operations efficiency at a low operating cost. This topic describes how to create Agentic BAS tasks, configure access credentials and the maximum Credits usage, manage task statuses, view and verify vulnerabilities, and view Credits consumption.

Scope

Asset authorization: The target assets to be tested must be IP addresses or domain names that you are legally authorized to test.
Supported target assets:
- Assets managed by Security Center (ECS instances that have a public IP address).
- Assets discovered by Attack Management scanning and inventoried as Attributed assets.
- Custom assets: IP addresses, domain names, or complete URLs that start with http:// or https://. The ownership of the primary domain name or IP address must be verified first. After verification, you can add the corresponding subdomains, URLs, or addresses in the ip:port format.

Supported vulnerability detection types:

Vulnerability type	Description
Unauthorized Access	Detects privilege escalation or unauthorized access vulnerabilities in the system.
Cross-Site Scripting (XSS)	Injects malicious scripts to steal user data.
SQL Injection	Detects SQL injection vulnerabilities.
Cross-Site Request Forgery (CSRF)	Forges user requests to perform unauthorized operations.
Common Vulnerabilities	Detects other common web security vulnerabilities.

Add scanner IP addresses to an allowlist

If your network uses Web Application Firewall (WAF), Cloud Firewall, or another access control policy, add the scanner IP addresses to the allowlist of the target server to prevent scan requests from being blocked.

Outside Chinese Mainland: 8.219.211.171
Chinese Mainland: 8.133.212.119, 121.40.209.82

Create an Agentic BAS task

Access the Security Center console - Risk Governance - Agentic BAS. In the upper-left corner of the page, select the region of your assets: Chinese Mainland or Outside Chinese Mainland.
In the upper-right corner of the page, click Create Penetration Test Task.

In the Create Penetration Test Task panel, configure the following parameters.

Parameter	Description
Task Name	A custom task name of up to 128 characters.
Task Description	Additional notes about this penetration test, up to 1,000 characters.
Select Vulnerabilities	Select the vulnerability types to detect. You can select multiple types. The available types are: Unauthorized Access, Cross-Site Scripting (XSS), SQL Injection, Cross-Site Request Forgery (CSRF), Common Vulnerabilities.
Penetration Requirements	Describe additional penetration testing requirements or areas of focus in natural language.
Target Selection	Select the source of the detection targets. Three sources are available: Security Center Assets: Security Center-managed assets (ECS instances with public IP addresses). You can view the connected ECS assets in the left-side navigation pane under Asset Center > Host. Attack Surface Assets: Attack Management assets discovered by attack surface scanning and inventoried as Attributed. For more information, see . Custom Assets: IP addresses, domain names, or complete URLs that start with http:// or https://. Enter an IP address or domain name in the search box to select from verified custom assets. To add a new asset, click Create Asset and Verify and complete the asset verification. For details, see Advanced configuration - Configure custom assets.
Access Credentials (optional)	Used for logon authentication and privilege escalation testing. Configure credentials for identities that have different permissions to make the penetration test more thorough, as described in Advanced configuration - Configure access credentials. Note If you do not add credential information, the penetration task runs without identity authentication.
Max Credits Usage (optional)	Optional. After you enable this parameter, when the Credits usage reaches the configured maximum during task execution, the system handles it based on the selected action: when you select Terminate the task (default), the task ends and cannot be resumed in the console. A report is generated based on the findings already produced; when you select Pause the task, the task is suspended at the pause point and can be resumed within the keep-alive period. After resumption, the Credits usage is no longer limited by this maximum. Drag the slider (range 0 to 5,000,000, default 500) or enter the value directly. Note Credits usage differs by execution stage, so actual consumption may slightly exceed the configured maximum.
Execution Mode	Select how the task runs: Run Now: starts the penetration test immediately after the task is created. Run Once on Schedule: starts the penetration test once automatically at the specified time.
Execution Time	Required when you select Run Once on Schedule. The execution time cannot be earlier than the current time.

After you verify the configuration, click OK. A Agentic BAS task takes a long time to run and may exceed 1 hour. Wait for the task to complete.
Important
The default task timeout is 12 hours. If a task runs longer than 12 hours, the system automatically pauses it and marks it as an automatic pause. An automatically paused task is handled the same way as a manually paused task: you can resume it within the keep-alive period, and the task terminates when the period expires. The scanned data is retained, and the consumed Credits are not refunded.

Handle and verify vulnerabilities

View and handle vulnerabilities

In the task list, click the target task name, or click Details in the Actions column.
On the Vulnerabilities tab, view the list of vulnerabilities that the current task detected. You can select one or multiple vulnerabilities (the header allows you to select all). After selection, the Verify and Download Report buttons appear at the bottom of the list, allowing you to batch verify or batch download reports for the selected vulnerabilities.
In the Actions column of a vulnerability, click Download Report to download the vulnerability details, such as the endpoint, discovery time, vulnerability discovery process, and remediation plan.
Fix the vulnerability manually based on the remediation plan in the report.
Note
Agentic BAS does not support fixing vulnerabilities directly in the console.

Verify vulnerability remediation

After you complete the manual fix, return to the vulnerability list to verify whether the vulnerability is fully fixed.

Trigger verification:
1. In the task list, click the target task name, or click Details in the Actions column.
2. On the Vulnerabilities tab, click Verify in the Actions column of the target vulnerability.
  Note
  To verify multiple vulnerabilities in a batch, select the checkboxes of the target vulnerabilities on the Vulnerabilities tab, and then click Verify at the bottom of the list.
3. On the verification details page, click Verify in the upper-right corner. The vulnerability effectiveness changes to Verifying, the Tea Agent starts reproduction verification, and verification logs are written in real time.
Verification complete: After verification completes, a record is added to Verification History, and the Credits consumed are added to the total verification consumption of the vulnerability. The verification statuses are as follows:
1. Exploitable: the verification process ran without errors, the vulnerability is reproducible and exploitable, and the verification result is written to the log.
2. Not Exploitable: the vulnerability is fixed or isolated after verification and cannot be reproduced. Use the verification log to further confirm the fix result.
  Note
  Credits already consumed are not refunded for Not Exploitable results caused by network errors, temporary interruptions, or other factors that prevent complete verification.
Confirm the vulnerability fix result: In the CONSOLE output box of the Verification Logs section, view the verification process log. The fix result is usually printed on the last line, for example, "Retest conclusion ### Vulnerability status: Not Fixed (Vulnerable)".
Download verification logs: In the Verification Logs section, click Download Logs in the upper-right corner of the CONSOLE output box.

View or download the Agentic BAS Report

In the task list, click the target task name, or click Details in the Actions column.
On the Agentic BAS Report tab, view the report online. To save the report locally, click Download Report in the upper-right corner.

Manage Agentic BAS tasks

Manage a single task: In the task list, click the icon in the Actions column of the target task to perform the following operations:

Operation	Applicable task status	Description
Start	To Be Started	Runs the current task immediately.
Stop	Running	Terminates the running penetration test task. After termination, the system generates a complete report based on the findings already produced, and the task consumption is counted toward Credits usage. The task cannot be resumed in the console.
Pause	Running	Manual pause: Applies only to running tasks. Credits are not consumed during the pause. You can resume execution from the pause point. Automatic pause: If the penetration task runs for more than 12 hours, it is automatically changed to the paused status. Important The pause keep-alive period is 15 days (360 hours). If the task is not resumed before the period expires, it is treated as manually terminated. The system generates a complete report based on the findings already produced, and the task consumption is counted toward Credits usage.
Delete	Not running	Deletes the penetration test task and its result data. The deletion cannot be restored.

Batch operations: Supports batch start, pause, stop, or delete of multiple tasks with the same status.
1. On the Agentic BAS task list page, select one or more tasks that have the same status.
2. In the lower-right corner of the list, click Start, Pause, Stop, or Delete.

View Credits consumption

View task consumption

View the consumption of a single task:
1. In the task list, click the target task name, or click Details in the Actions column.
2. In the Task Overview section of the Task Details tab, view Credits Consumed.
View the overall consumption: In the Credits Used / Remaining section of the Agentic BAS homepage, view the consumption percentage and the remaining amount of Plan Credits.

View vulnerability verification consumption

Important

The Credits consumed by vulnerability verification are metered separately from the Credits consumed by task execution.

In the task list, click the target task name, or click Details in the Actions column.
On the Vulnerabilities tab, click Verify in the Actions column of the target vulnerability to go to the verification details page.
- In the Verification Records section, view Total Credits Consumed.
  Note
  You can also view the total verification consumption in the Credits Used for Verification column of the vulnerability list page.
- In the Verification History section, view the Credits Consumed of each single verification below the corresponding record.

Advanced configuration (optional)

Configure custom assets

To run a penetration test on a custom asset, add the asset and complete ownership verification. Enter an IP address, a domain name, or a complete URL that starts with http:// or https://. After the verification succeeds, the asset is added to the custom asset library, and you can select it each time you create a task.

Add assets: In the Target Selection section of the Create Penetration Test Task panel, select the Custom Assets tab.
- Select existing assets: Enter an IP address or domain name in the search box to select from verified custom assets.
- Add a new asset: Click the search box, then in the Create Custom Asset and Verify panel, enter the asset to be verified.
  Note
  IP addresses, domain names, or complete URLs that start with http:// or https://, or IP:Port are supported.
Verify assets: The first time you add an asset, you must verify the ownership of the primary domain name or IP address. Both DNS TXT Verification and File Verification are supported. The generated verification information has an expiration time. Complete the verification before it expires.
Warning
If the verification information has expired, click Re-verify Asset and use the new verification information to complete domain verification.
Note
When you verify a subdomain such as yyy.example.com, the system first verifies the subdomain itself. If that verification fails, the system automatically verifies the primary domain name example.com. You can configure the DNS TXT record on the primary domain name to improve the verification success rate.

DNS TXT Verification

Procedure

Log on to the domain name resolution website: find the entry for domain name resolution, DNS resolution, or resolution records, and then select the domain name that you want to verify. If the domain name resolution is hosted in Alibaba Cloud DNS, log on to the Alibaba Cloud DNS console instead. If you cannot find the entry, contact your domain name administrator.
Create and complete a TXT record: on the Add Record or Add Resolution page, fill in each field based on the Record Type (TXT), Hostname / Name, and Record Value values that the console provides. For a field-by-field example, see the DNS configuration example in this tab.
Save the record and wait for it to take effect: click OK or Save, and retain this record.
Important
DNS resolution does not take effect immediately. The wait time depends on the DNS service provider and the TTL configuration.
After the record takes effect, return to the Create Custom Asset and Verify panel and click Verify and Save Asset.

Note

When you verify a subdomain, the system first checks the TXT record of the subdomain. If the check fails, the system then checks the TXT record of its primary domain. Therefore, you can add the TXT record either to the subdomain that you want to verify or to its primary domain. For example, when you verify yyy.xxx.com, you can add the TXT record directly under the primary domain xxx.com.

DNS configuration example

This example uses a domain name whose resolution is hosted in Alibaba Cloud DNS. If your domain name resolution is hosted with another DNS service provider, add the record with the same parameters on the resolution settings page of that provider.

Use the Alibaba Cloud account of the domain name owner to log on to the Alibaba Cloud DNS console.
In the domain name list, find the target domain name and click Settings in the Actions column to go to the resolution settings page.

On the resolution settings page, click Add Record and complete the following fields.

Parameter	Description
Type	Select TXT.
Host Record	Paste the Hostname / Name that the Create Custom Asset and Verify panel provides, for example, `_aibas-verification`.
Record Value	Paste the Record Value that the Create Custom Asset and Verify panel provides, in the format `aibas-site-verification=<verification-string>`.

Keep other parameters, such as the resolution request source and TTL, at their default values.

After you complete all fields, click OK.

File Verification

Procedure

Download or create the verification file: Click Download Verification File to save the file locally. You can also create the file manually based on the Upload Path / File Name and File Content that the console provides.
Important
The file name and file content must exactly match the content that the console provides. Do not rename the file, add or delete content, or add spaces.
Create the directory path: Log on to your web server, object storage, or website management backend. Then create the directory path .well-known/pki-validation/ under the web root directory, as specified in the File Content field. If the path already exists, skip this step.
Place the file: Upload the verification file to the path that corresponds to the Upload Path / File Name value in the panel. For an end-to-end example that uses Nginx (Linux) deployed on an Alibaba Cloud ECS instance, see the file upload configuration example in this tab.
Check the verification URL in a browser: Copy the Verification URL that the console provides and open it in an incognito browser window.
Important
You must be able to see the verification file content without logging on. If a 404 error, a 403 error, a logon page, or a redirect page appears, adjust the file location or the access permissions first.
After you confirm that the content displayed in the browser exactly matches the File Content that the console provides, click Verify and Save Asset.
Warning
Do not delete or modify the file before the verification succeeds. Otherwise, the verification may fail.

File upload configuration example

This example uses Nginx (Linux) deployed on an Alibaba Cloud Elastic Compute Service (ECS) instance. If your website is deployed on another server or in object storage, follow the same procedure to place the file at the location that corresponds to the Upload Path / File Name value.

Connect to the ECS instance. For more information, see Connect to an ECS instance.
Create the directory: Run the following commands in sequence to create the directory level by level under the web root directory of the server (/var/www/html/ by default for Nginx), based on the Upload Path / File Name value that the Create Custom Asset and Verify panel provides. If the directory already exists, skip this step. The following commands use .well-known/pki-validation/ as an example path. Replace it with the path that the panel provides.
```
cd /var/www/html mkdir -p.well-known/pki-validation
```
Upload the verification file: Use the file upload feature of a remote logon tool such as WinSCP or Xshell to upload the file to the directory created in the previous step, as described in Upload files.
Open the Verification URL that the panel provides in an incognito browser window and confirm that you can access the verification file content directly. The URL combines the verification path with the file name, for example, https://domain-name/.well-known/aibas-site-verification/file-name.txt. Always open the URL exactly as the panel provides it.

Configure access credentials

To use logon authentication and privilege escalation testing, configure access credentials for identities that have different permissions to make the penetration test more thorough. Each identity requires only one type of access credential. If you switch the credential type, only the currently selected credential is submitted. Configure access credentials in three steps:

Credential type selection: Select the credential type based on how users log on to the target site.
Get the credential content: Get the credential information to be filled in from the browser or the authorized test environment based on the selected type.
Configuration steps: Enter the identity information and credential content in the Create Penetration Test Task panel.

Credential type selection

Credential type	Scenario	Common acquisition location
Username/Password	The site supports authentication through a standard logon form.	Provided by the owner of the test account.
Cookie	You are already logged on in a browser or a proxy tool and want to reuse the logon state directly.	Browser DevTools, Burp, curl.
Local Storage	The token or identity information is persisted in the local storage of the browser.	DevTools > Application > Local Storage.
Session Storage	The token is stored only in the current browser session.	DevTools > Application > Session Storage.
Additional Headers (Advanced)	The site passes the token, tenant, or identity information in fixed request headers.	DevTools > Network > Request Headers.

Configuration recommendations

Use temporary credentials that have the least privilege and can be revoked at any time. Do not use your personal day-to-day account or a high-privilege production account.
Immediately after the test finishes, disable the temporary account, rotate the password, or revoke the token, and clear logon states that are no longer needed.
Multi-identity and privilege escalation testing: to run horizontal or vertical privilege escalation tests, prepare at least two temporary identities that have different permissions. For example:
- Regular user A: standard business permissions.
- Regular user B: a data scope that differs from that of user A, used for horizontal privilege escalation checks.
- Administrator: used to compare the behavior of high-privilege and low-privilege identities.
If a logon state depends on multiple types of client-side data, select the primary credential type that can restore the logon state independently. Each identity currently submits only one credential type.

Get the credential content

The location of the credential content differs by credential type. Log on to the target site with an authorized test account first, and then get the corresponding content based on the selected credential type.

Account and password

For Username/Password, the account owner provides an authorized test account. You must enter both the account and the password. Use a low-risk temporary test account that has the least privilege and can be disabled at any time. Do not enter a high-privilege production account.

Important

If the logon process depends on a manual CAPTCHA, multi-factor authentication, or another interactive operation, log on in a browser first, and then use Cookie, Local Storage, or Session Storage to reuse the existing logon state.

Cookie

Log on to the target site with the test account.
Open the developer tools of the browser.
In Network, select a request that is already authenticated and find Cookie in Request Headers. You can also view the existing cookies of the site in Application > Cookies.

Copy the cookie text. The following formats are common:

Single-line cookie:

Cookie: SESSION=abc123; tenant_id=tenant-a

Set-Cookie text with attributes:

Set-Cookie: SESSION=abc123; Domain=.example.com; Path=/; Secure; HttpOnly; SameSite=Lax

Multiple groups, one group per line:

Cookie: SESSION=abc123; tenant_id=tenant-a Cookie: locale=zh-CN

Make sure that the copied cookie text meets the following format requirements:
- Use = between the cookie name and the cookie value, and separate multiple cookies with a semicolon (;).
- You can keep the Cookie: or Set-Cookie: prefix.
- The Domain, Path, SameSite, Secure, and HttpOnly attributes are recognized.
- Paste only the cookie or Set-Cookie text. Do not paste the complete HTTP request.
Note
Cookies have a validity period. If the logon state is lost while the task runs, log on again and get the latest cookie.

Local Storage

Log on to the target site with the test account.
Open the developer tools of the browser and go to Application > Local Storage.
Select the origin that corresponds to the target site.
Copy each authentication-related key and value and enter them in the Key/Value fields of the credential. Example:
Key
Value (example)
auth_token
<temporary-token>
user_profile
{"role":"viewer"}

Session Storage

Important

Session storage is usually bound to the current session. If you log on again or close the session, or if the credential expires, the original values may become invalid and you must get them again.

Log on to the target site with the test account and keep the session of the current tab valid.
Open the developer tools of the browser and go to Application > Session Storage.
Select the origin that corresponds to the target site.
Copy each authentication-related key and value. Enter them as described for Local Storage.

Additional headers

Log on to the target site with the test account.
Open the developer tools of the browser and go to Network.
Select an authenticated request. In Request Headers, confirm the fixed request headers that are used for authentication or tenant identification. Entry example:
Key
Value (example)
Authorization
Bearer <temporary-token>
X-Tenant-Id
tenant-a
Note
Only fixed headers are recommended. Dynamic signature fields such as timestamps, nonces, one-time tokens, and request body digests are generated by the site itself. Do not enter them as fixed headers.

Configuration steps

In the Create Penetration Test Task panel, click Add Identity in the Access Credentials section to configure access credentials for identities that have different permissions.

In the Add Credential dialog box, configure the following parameters and click Save Identity.

Note

To configure multiple identities, click Add Identity again and continue to add identities.

Parameter	Description
Identity Name	Required. A custom identity name, such as administrator, regular user, or test user. The name can be up to 32 characters long and must be unique within the same task.
Identity Description	Optional. An additional description of the permission characteristics of the identity, such as "an authorized test identity that has read-only permissions". The description can be up to 200 characters long.
Select Credential Type	Required. Select one of the following five credential types: Username/Password, Cookie, Local Storage, Session Storage, and Additional Headers (Advanced). For selection guidance, see .
Credential content	Enter the credential information based on the selected credential type. For how to get each type of credential and the entry requirements, see .

Common validation prompts and how to handle them

Prompt or symptom	How to handle it
The identity name already exists	Change the name to one that is unique within the same task.
No valid cookie is parsed	Check the `name=value` format and the semicolon separators. Add the `Cookie:` prefix and try again.
Enter at least one valid key-value pair	Check whether the keys and values of Local Storage, Session Storage, or Headers are complete.
The task still runs as an unauthenticated user	Check whether the credential has expired, whether the cookie domain and path match, whether the storage type and origin are correct, and whether the key uses consistent capitalization.
Tenant or business permissions are still missing after logon	Check whether a fixed tenant header is also required, or whether the current test account has the target permissions.

Appendix: Task status descriptions

In the task list, you can view the current status of each task in the Status column. Hover over a status to view a tooltip. The following table describes each task status:

Task status	Description
To Be Started	The task is created but has not started yet.
Queuing	The task is triggered and is waiting in the execution queue.
Starting	The task is starting the execution environment.
Running	The penetration test is running. Credits usage is accumulated in real time.
Success	The task is complete. You can view and download the penetration test report.
Failure	The task is interrupted and the penetration process is terminated. For example, "Failure cause: The connection to the target asset timed out, the agent could not establish an access channel, and the penetration process was interrupted."
Paused	The task is suspended at the pause point. Credits are not consumed during the pause. You can resume the task from the pause point. Important The pause keep-alive period is 15 days (360 hours). If the task is not resumed before the period expires, it is treated as manually terminated. The system generates a complete report based on the findings already produced, and the consumed Credits are billed.
Stopped	The penetration task is terminated due to a system exception or manual intervention. The system generates a complete report based on the findings already produced, and the consumed Credits are billed. The task cannot be resumed in the console.
Timed Out	After the task runs for more than 12 hours, it is automatically changed to the Paused status. The subsequent processing logic is the same as that of a manually paused task.

Note

When a penetration task is terminated due to a system exception, the system still generates a complete report based on the existing findings, and the consumed Credits are billed as usual.

Key	Value (example)
`auth_token`	`<temporary-token>`
`user_profile`	`{"role":"viewer"}`

Key	Value (example)
`Authorization`	`Bearer <temporary-token>`
`X-Tenant-Id`	`tenant-a`