Documentation / PAC Management

PAC File

PAC Config File Reference

The PAC file is the YAML manifest that defines a single Prancer pentest: which application to test, on which cloud, with which scanner, against which target, with which authentication, and with what scope. Generate it via the PAC Wizard or write it by hand.

Tip: start with a wizard-generated file and edit from there. Editing by hand without a baseline is the most common cause of failed runs.

Before you start

  • A collection and connector to reference.
  • *(For authenticated scans)* secrets stored in Vault / Azure Key Vault / AWS Secrets Manager / GCP Secret Manager.
  • A target URL.

Example — Azure pentest

ConnectionName: test_azure_connector
CloudType: azure
ApplicationName: test_log4j
RiskLevel: attack
Compliance:
  - CIS
  - CSA-CCM
ApplicationType: WebScan
Schedule: onetime
Target: http://20.110.226.159:8081
ResourceID: dummyResourceID
paths:
  exclude: []
  include: []
CVE:
  - Path:
      Include:
        - .*\.js
        - abc.java
      Exclude:
        - .*\.py
    Connector: azure_custom_script_connector
Scanner:
  Cloud:
    Platform:
      Azure:
        ContainerInstance:
          AfterRun: stop
          NewContainerInstance:
            External:
              SubscriptionId: a6941677-4c37-42fb-960c-dad8f25060a3
              ResourceGp: pac
              Region: eastus
              ContainerGroupName: Prancer-scanner-group
              ContainerName: Prancer-pentest-instance
              ResourceName: Prancer-instances
AuthenticationMethod: noAuthentication
AddOns:
  - accessControl
  - ascanrulesAlpha

Top-level fields

| Field | Notes |

| ------- | ------- |

| ConnectionName | Connector name used to reach the cloud. |

| CloudType | azure, aws, or gcp. |

| ApplicationName | Identifier for this PAC file. |

| ApplicationType | WebScan or APIScan. |

| Target | URL to attack. |

| ResourceID | ARN-style resource ID (mostly AWS). |

| paths | Include / exclude scope for the scanner. |

| AuthenticationMethod | noAuthentication, formBasedAuthentication, jsonBasedAuthentication, jwtAuthentication, cookieAuthentication, oauthAuthentication, customAuthentication. |

| AddOns | List of ZAP add-ons to load. |

| Scanner | Cloud-specific scanner provisioning (see below). |

ConnectionName

Used to find the connector Prancer uses to reach the cloud. See the Connector reference for details.

Warning: there can only be one ConnectionName per PAC file when using a supported cloud type, and it must exist in the same collection as the PAC file.

CloudType — Azure

Prancer creates an ACI (Azure Container Instance) scanner from a managed image and runs the pentest there. Findings are streamed back to your dashboard.

Scanner:
  Cloud:
    Platform:
      Azure:
        ContainerInstance:
          AfterRun: stop
          NewContainerInstance:
            External:
              SubscriptionId: a6941677-4c37-42fb-960c-dad8f25060a3
              ResourceGp: pac
              Region: eastus
              ContainerGroupName: Prancer-scanner-group
              ContainerName: Prancer-pentest-instance
              ResourceName: Prancer-instances

| Field | Description |

| ------- | ------------- |

| AfterRun | stop or delete after the scan. |

| SubscriptionId | Azure subscription where the scanner is created. |

| ResourceGp | Resource group inside that subscription. |

| Region | Azure region. |

| ContainerGroupName | ACI group name to create. |

| ContainerName | Container name inside the ACI. |

| ResourceName | Logical resource name. |

CloudType — AWS

Prancer creates an ECS Fargate scanner.

Scanner:
  Cloud:
    Platform:
      AWS:
        AfterRun: delete
        NewFargate:
          External:
            AccountId: "18993667260"
            Region: us-west-2
            TaskDefinition: pentest-task
            ClusterName: pentest-cluster
            SecurityGroup: pentest-security-group
            ContainerName: Prancer-scanner-4
            SubnetId: subnet-bdcdcff6

| Field | Description |

| ------- | ------------- |

| AfterRun | stop or delete. |

| AccountId | Target AWS account. |

| Region | AWS region. |

| TaskDefinition | ECS task definition name. |

| ClusterName | ECS cluster name. |

| SecurityGroup | SG attached to the EC2 instance. |

| ContainerName | Scanner container name. |

| SubnetId | Subnet for the Fargate task. |

APIScan mode

When ApplicationType: APIScan, you can reference a Swagger or Postman manifest.

Swagger

APIScan:
  Type: OpenAPI
  DirectionProvider: "link"
  Direction:
  SwaggerFile: https://petstore.swagger.io/v2/swagger.json
  Connector:
  PostmanRemoteFile:
  PostmanEnvRemoteFile:

Postman

APIScan:
  Type: OpenAPI
  DirectionProvider: "git"
  Direction:
  SwaggerFile:
  Connector: <<git connector>>
  PostmanRemoteFile: <<file location in git repo>>
  PostmanEnvRemoteFile: <<file location in git repo>>
Tip: see the full Postman walkthrough in Postman Integration.

Authentication blocks

jwtAuthentication

JWTAuth:
  UsernameSecretKey: crUsername
  PasswordSecretKey: crPassword
  LoginUrl: /identity/api/auth/login
  LogoutUrl: /identity/api/auth/logout
  LoginBodyTemplate: '{"email":"%username%","password":"%password%"}'
  LoginIndicator: auth_token
  AuthorizationType: Header
  AuthorizationKey: Authorization
  AuthorizationTokenType: Bearer

| Field | Description |

| ------- | ------------- |

| UsernameSecretKey / PasswordSecretKey | Secret names in Key Vault / Secrets Manager. |

| LoginUrl / LogoutUrl | Login endpoint and logout to exclude. |

| LoginBodyTemplate | Template for the login request body. |

| LoginIndicator | String found in a successful login response (regex or path like body.token). |

| AuthorizationType | Header or Body. |

| AuthorizationKey | Header name (typically Authorization). |

| AuthorizationTokenType | Prefix (e.g. Bearer). |

formBasedAuthentication

FormBaseAuth:
  UsernameSecretKey: username
  PasswordSecretKey: password
  LoginUrl: /login
  LogoutUrl: /logout
  LoginRequestPostData: identifier={%username%}&password={%password%}
  LoginIndicator: "logout"

noAuthentication

AuthenticationMethod: noAuthentication

CVE — custom scripts

Embed custom ZAP scripts pulled from a Git connector.

CVE:
  - Path:
      Include:
        - .*\.js
        - abc.java
      Exclude:
        - .*\.py
    Connector: azure_custom_script_connector

| Field | Description |

| ------- | ------------- |

| Path.Include | Regex paths to include. |

| Path.Exclude | Regex paths to skip. |

| Connector | Git connector name. |

→ Full walkthrough: Custom Attack.

AddOns

ZAP add-ons to load alongside the scan. Auto-loaded based on application type, or specify explicitly:

AddOns:
  - accessControl
  - ascanrulesAlpha

→ Full list: zaproxy.org/addons.

AWS sample

ConnectionName: test_shahin_aws_ws_att_connector
CloudType: aws
ApplicatioName: test_shahin_aws_ws_att_app
RiskLevel: attack
Compliance:
  - CIS
  - CSA-CCM
  - HIPAA
ApplicationType: WebScan
Schedule: onetime
Target: https://ctflearn.com
ResourceID: dummyResourceID
paths:
  exclude: []
  include: []
Scanner:
  Cloud:
    Platform:
      AWS:
        AfterRun: delete
        NewFargate:
          External:
            AccountId: "15557887260"
            Region: us-west-2
            TaskDefinition: pentest-task
            ClusterName: pentest-cluster
            SecurityGroup: pentest-security-group
            ContainerName: Prancer-scanner-4
            SubnetId: subnet-bdcdcff6
AuthenticationMethod: noAuthentication

Next steps