User Guide
Chapter 2: Getting Started
These types of issues are environmentally specific, though McAfee IPS is known to cause both types
of problems, and any WAF will cause the first problem. Fortify has seen other issues related to these
tools as well.
If such issues arise while conducting a scan, Fortify recommends that you disable WAF, anti-virus
software, firewall, and IDS/IPS tools for the duration of the scan. Doing so is the only way to be sure
you are getting reliable scan results.
Effects to Consider
During an audit of any type, Fortify WebInspect submits a large number of HTTP requests, many of
which have "invalid" parameters. On slower systems, the volume of requests may degrade or deny
access to the system by other users. Additionally, if you are using an intrusion detection system, it will
identify numerous illegal access attempts.
To conduct a thorough scan, Fortify WebInspect attempts to identify every page, form, file, and folder
in your application. If you select the option to submit forms during a crawl of your site, Fortify
WebInspect will complete and submit all forms it encounters. Although this enables Fortify
WebInspect to navigate seamlessly through your application, it may also produce the following
consequences:
l
If, when a user normally submits a form, the application creates and sends e-mails or bulletin board
postings (to a product support or sales group, for example), Fortify WebInspect will also generate
these messages as part of its probe.
l
If normal form submission causes records to be added to a database, then the forms that Fortify
WebInspect submits will create spurious records.
During the audit phase of a scan, Fortify WebInspect resubmits forms many times, manipulating every
possible parameter to reveal problems in the applications. This greatly increases the number of
messages and database records created.
Helpful Hints
l
For systems that write records to a back-end server (database, LDAP, and so on) based on forms
submitted by clients, some Fortify WebInspect users, before auditing their production system,
backup their database, and then reinstall it after the audit is complete. If this is not feasible, you can
query your servers after the audit to search for and delete records that contain one or more of the
form values submitted by Fortify WebInspect. You can determine these values by opening the Web
Form Editor.
l
If your system generates e-mail messages in response to user-submitted forms, consider disabling
your mail server. Alternatively, you could redirect all e-mails to a queue and then, following the
audit, manually review and delete those e-mails that were generated in response to forms
submitted by Fortify WebInspect.
l
Fortify WebInspect can be configured to send up to 75 concurrent HTTP requests before it waits
for an HTTP response to the first request. The default thread count setting is 5 for a crawl and 10
for an audit (if using separate requestors). In some environments, you may need to specify a lower
Micro Focus Fortify WebInspect (22.2.0)
Page 43 of 503