GitHub Enterprise Server
Copy page
GitHub Enterprise Server
This guide is for GitHub Enterprise Server customers with a custom domain. Organisations on GitHub.com use the GitHub guide instead.
Configure access
You can give Hacktron access to a GitHub Enterprise Server instance in two ways:
| Method | Used for |
|---|---|
| GitHub App (recommended) | Whitebox pentests, and Review for the repositories you select |
| Personal access token | Whitebox pentests only |
The GitHub App flow registers a GitHub App on your server and redirects you to your instance to create it. A GitHub organisation owner must complete it.
A personal access token gives Hacktron access to repositories for Whitebox pentests.
Warning
Pull request reviews are not available with a personal access token. Use the GitHub App for them.
Configure GitHub App
Open Integrations
In Hacktron, go to Integrations and click Connect under GitHub Enterprise Server.
The GitHub Enterprise Server row in Hacktron’s Integrations
Start the GitHub App installation
Enter your server’s base URL, such as https://github.example.com, and the organisation name.
Warning
You must be an owner of the organisation to install the GitHub App.
Sign in to your server
If GitHub asks you to sign in, enter your GitHub credentials as usual.
Register Hacktron as a new GitHub App
GitHub asks you to create a new GitHub App. Give it a descriptive name (hacktron-app by default).
Create GitHub App on the server, with the name hacktron-app
Click Create GitHub App. This creates a GitHub App with the permissions Hacktron needs.
Install the GitHub App
Your browser redirects you to install the app you registered.
Installing hacktron-app on an organisation, with the repository choice and the permissions it requests
Select the repositories to grant access to, then click Install.
Note
Hacktron asks for read access to code, members, and metadata, and read and write access to checks, issues, and pull requests. It needs them for Review, issue management, and opening pull requests. Hacktron keeps no source code once each review is complete.
Configure a personal access token
Open the personal access tokens page
Go to http://<your-server>/settings/personal-access-tokens/new, or click your avatar at the top right and select Settings, then Developer settings, then Personal access tokens.
Create the token
Give the token a descriptive name, such as “Hacktron”, and select the repositories to grant access to.
Tip
You can change this later.
Select these repository permissions:
read-only access to contents
read-only access to metadata (configured automatically)
Note
Whitebox pentests need these permissions.
Click Create token. Copy the token and save it somewhere secure.
Add the token to Hacktron
On the Integrations page in Hacktron, click Connect under GitHub Enterprise Server and select the Personal access token option.
The GitHub Enterprise Server dialog with the Personal access token option selected
Enter the token you created and click Connect GitHub Enterprise Server.
Use a GHES repository in a Whitebox pentest
On-premises deployments can use enabled GitHub Enterprise Server repositories as Whitebox pentest sources. Connect the instance first with either method on this page, then make sure the repository is enabled for the organisation.
When you create a Whitebox pentest:
Open Connected sources in the repository step.
Select the enabled GHES repository and the branch or commit to test.
Add the rest of the scope, calculate the cost, and start the pentest.
If the server uses a private network address, add its hostname to the appliance’s Internal Git host(s) setting. If it uses a private certificate authority, add that CA to Trusted CA certificates as well.
The on-premises guide covers first boot, internal Git access, and air-gapped support. The Whitebox quickstart covers selecting a source, defining the scope, and running the pentest.