Tutorials / Getting Started

Inventory Management

The Inventory Management section is where you can view and manage all resources that are approved for penetration testing. This module guides you through navigating and interacting with the inventory interface, understanding asset configuration, and leveraging filtering capabilities to customize your view.

To begin, click on Inventory Management from the left-hand navigation menu.

  • * *

Inventory View Modes

By default, the inventory is displayed in Tile View, offering a visual summary of each resource. You can switch to List View using the toggle at the top right to display the assets in a more condensed, tabular format—ideal for large inventories or advanced filtering.

<tutorialimage module="m2" index="1" alt="Image 5 — Module 2 (local #1)"></tutorialimage>

  • * *

PAC File (Prancer Application Configuration)

Each inventory item is associated with a PAC file, short for Prancer Application Configuration. This is a YAML-based manifest file that contains all relevant configuration details about the target resource, including:

<tutorialimage module="m2" index="2" alt="Image 6 — Module 2 (local #2)"></tutorialimage>

  • Target metadata
  • Compliance profiles
  • Authentication configuration
  • Application type
  • Security scanning preferences

To view a PAC file, click PAC Configuration. The manifest will open in an embedded editor. You are free to review and make changes if necessary—however, editing is entirely optional and intended for advanced users.

  • * *

Filtering the Inventory

At the top of the Inventory Management page, click on Add Filter to reveal a set of advanced filtering options. Filters are available in both Tile View and List View, and allow you to tailor your view based on specific parameters.

Available Filters:

  • Cloud Type

Filter by hosting environment:

  • Azure
  • AWS
  • GCP
  • Custom (e.g., on-premises or unmanaged cloud)
  • Collection

Filter based on the collection name that the asset belongs to.

  • Service

Lists detected services running on the host. During the first penetration test, Prancer runs an Nmap scan to detect open ports and services. The discovered services are automatically tagged in the corresponding PAC file.

  • Compliance

Narrow down targets based on supported security compliance standards. Prancer provides specific security test suites aligned with several compliance requirements.

  • Scan Type

Choose the type of scan to be performed on the target. Prancer supports full white-box security testing, including:

  • Penetration Testing
  • Fuzzing
  • CSPM (Cloud Security Posture Management)
  • SCA (Software Composition Analysis)
  • SAST (Static Application Security Testing)
  • DAST (Dynamic Application Security Testing)
  • Auth Method

Select targets based on the authentication method they use. Supported methods include:

  • JWT
  • Form-Based Authentication
  • Cookie-Based Authentication
  • OAuth
  • Custom (for proprietary or non-standard methods)
  • Application Type

Filter by application architecture:

  • Web Application
  • API (OpenAPI, SOAP, GraphQL, gRPC)
  • Status

View targets based on the current testing lifecycle:

  • Not Started
  • In Progress
  • Completed
  • Cancelled
  • Not Reachable
  • MITRE ATT&CK

If specific MITRE Tactics or Techniques were selected for the target, you can use this filter to identify relevant applications.

Also, the search box is available, and you can search based on the name of the PAC item:

  • * *

PAC Configuration ID

Each PAC file is assigned a unique Config ID, which serves as a key identifier for future reference, integration, and audit trails. Make note of this ID if you plan to automate or reference the configuration in subsequent modules or workflows.

  • * *

Additional Screenshots

Additional screenshots, in order of appearance.

<tutorialgallery module="m2" startIndex="3"></tutorialgallery>