Configuration and Usage Guide
Chapter 4: Configuring a Scan
Second, results or attacks that are in the ScanCentral DAST product, cached on disk locally, or in the
database can be identified and quarantined by these tools. When working files used by the
WebInspect sensor or data in the database are quarantined, the sensor can produce inconsistent
results. Such quarantined files and data can also cause unexpected behavior.
These types of issues are environmentally specific, though McAfee IPS is known to cause both types
of problems, and any WAF will cause the first problem. Fortify has seen other issues related to these
tools as well.
If such issues arise while conducting a scan, Fortify recommends that you disable WAF, anti-virus
software, firewall, and IDS/IPS tools for the duration of the scan. Doing so is the only way to be sure
you are getting reliable scan results.
Effects to Consider
During an audit of any type, the WebInspect sensor submits a large number of HTTP requests, many
of which have "invalid" parameters. On slower systems, the volume of requests may degrade or deny
access to the system by other users. Additionally, if you are using an intrusion detection system, it will
identify numerous illegal access attempts.
To conduct a thorough scan, the WebInspect sensor attempts to identify every page, form, file, and
folder in your application. If the option to submit forms during a crawl of your site is selected, the
sensor will complete and submit all forms it encounters. Although this enables the sensor to navigate
seamlessly through your application, it may also produce the following consequences:
l
If, when a user normally submits a form, the application creates and sends e-mails or bulletin board
postings (to a product support or sales group, for example), the WebInspect sensor will also
generate these messages as part of its probe.
l
If normal form submission causes records to be added to a database, then the forms that the
WebInspect sensor submits will create spurious records.
During the audit phase of a scan, the WebInspect sensor resubmits forms many times, manipulating
every possible parameter to reveal problems in the applications. This greatly increases the number of
messages and database records created.
Helpful Hints
l
For systems that write records to a back-end server (database, LDAP, and so on) based on forms
submitted by clients, some ScanCentral DAST users, before auditing their production system,
backup their database, and then reinstall it after the audit is complete. If this is not feasible, you can
query your servers after the audit to search for and delete records that contain one or more of the
form values submitted by the WebInspect sensor. You can determine these values by opening the
Web Form Editor.
l
If your system generates e-mail messages in response to user-submitted forms, consider disabling
your mail server. Alternatively, you could redirect all e-mails to a queue and then, following the
audit, manually review and delete those e-mails that were generated in response to forms
submitted by the WebInspect sensor.
Micro Focus Fortify ScanCentral DAST (22.2.0)
Page 129 of 338