IBM Security Appscan Standard: User Guide Traffic Log
Total Page:16
File Type:pdf, Size:1020Kb
IBM Security AppScan Standard Version 9.0.3.11 User Guide IBM Contents Chapter 1. Introduction ........ 1 Content-Based Results view ........ 90 Product overview............. 1 Glass Box view ............ 92 Supported technologies .......... 1 Communication and Proxy view ...... 93 What's new ............... 2 HTTP Authentication view ........ 94 Contact and support information ....... 3 Test Policy view ............ 95 Test Optimization view ......... 100 Chapter 2. Installing ......... 5 Test Options view ........... 100 Privilege Escalation view ........ 103 System requirements............ 5 Malware view ............ 104 Flash Player upgrade .......... 7 Scan Expert view ........... 104 Flash Player configuration ......... 7 Advanced Configuration view....... 106 Install................. 8 Scan file structure ............ 121 Silent install .............. 8 Scan templates ............. 121 Uninstall................ 9 Predefined templates .......... 121 License ................ 9 User-Defined Scan Templates ....... 123 Load a node-locked license ........ 10 Loading scan templates ......... 123 Load a floating or token license....... 11 Editing Scan Templates ......... 123 Updates ............... 11 Changing the configuration during a scan .... 124 Temp file location ............ 12 Chapter 3. Getting started ...... 13 Chapter 5. Manual Exploring ..... 125 Using AppScan............. 125 How an automatic scan works ........ 13 Recording a Manual Explore ....... 126 Web applications vs. web services ....... 14 Exporting Manual Explore data ...... 128 Basic workflow ............. 15 Importing Manual Explore data ...... 129 Workflow description .......... 16 Using AppScan as a proxy server...... 130 Tour of the main window ......... 17 Using AppScan as recording proxy ...... 131 View selector ............. 17 Exploring with the External Traffic Recorder .. 131 Application Tree ............ 18 External Login Recorder ......... 133 Result List .............. 20 External Traffic Recorder ........ 133 Detail Pane ............. 21 Using GSC .............. 134 Scan panels ............. 21 Exploring with GSC .......... 135 Status bar .............. 21 Scanning a site that includes a SOAP web Tutorial................ 22 service as part of the site ........ 136 Step 1: Configuring the scan........ 22 Step 2: Running the scan ......... 23 Step 3: Reviewing Scan Results ....... 24 Chapter 6. Scanning ........ 137 Step 4: Communicating results ....... 25 Starting scans ............. 137 Sample scans .............. 25 Starting scans from the Scan Configuration Wizard .............. 137 Chapter 4. Configuring ........ 27 Starting scans from the Scan menu or the toolbar .............. 137 Scan configuration wizard ......... 27 Starting scans from the Welcome dialog box .. 138 Launching the Scan Configuration Wizard ... 28 Starting scans from the New Scan dialog box 139 Wizard for exploring with AppScan ..... 29 Scan progress ............. 139 Wizard for exploring with an external device or Pausing and continuing scans ........ 140 client ............... 34 Scans stopped due to connectivity issues ... 140 Wizard for exploring with GSC ....... 38 Scans stopped due to application issues ... 140 Scan configuration dialog box ........ 40 Saving and loading scans ......... 141 URL and Servers view.......... 41 Saving scans............. 141 Login Management view ......... 45 Automatic scan save .......... 141 Environment Definition view ....... 57 Loading saved scans .......... 142 Exclude Paths and Files view ....... 58 Importing a legacy scan template...... 142 Explore Options view .......... 63 Automatic scan............. 142 Parameters and Cookies view ....... 68 Automatic multiphase scanning ...... 143 Automatic Form Fill view ........ 80 Scan Expert .............. 143 Error Pages view ........... 82 Scan Expert recommendations ....... 144 Multi-Step Operations view ........ 85 iii Glass box scanning ........... 144 Viewing and saving reports ....... 210 Overview.............. 144 Creating partial reports ......... 210 For Java platforms........... 145 Earlier versions of report templates ..... 211 For .NET platforms .......... 164 Security reports............. 211 Partial scans .............. 169 Limiting the size of Security reports ..... 213 Scan Multi-Step Operations Only ...... 170 Industry Standard and Compliance reports ... 214 Changing the configuration during a scan ... 170 Industry Standard reports ........ 214 Exporting scan results .......... 170 Regulatory Compliance reports ...... 216 Generating scan result DB and XML files ... 171 User-defined reports .......... 219 Firebird database structure ........ 171 Delta Analysis reports .......... 226 Template-based reports .......... 228 Chapter 7. Results: Application Data 177 Creating a custom report template ..... 229 Application Data: Application Tree ...... 177 Importing a custom template ....... 233 Application Data: Result List ........ 177 Requests .............. 178 Chapter 11. Tools.......... 235 Parameters ............. 178 Options dialog box ........... 235 Cookies .............. 179 Scan Options tab ........... 235 Failed Requests............ 180 Preferences tab ............ 236 Filtered URLs ............ 180 Recording Proxy tab .......... 237 User Interaction Needed......... 181 General tab ............. 240 Comments ............. 182 Advanced tab ............ 240 JavaScript ............. 182 Web Services Configuration wizard ...... 241 Application Data: Detail Pane ........ 183 Description files ........... 241 Domains .............. 242 Chapter 8. Results: Security Issues 185 Login Management .......... 242 Security Issues: Application Tree ....... 185 Sequences ............. 243 Exclude URL from scan ......... 185 Parameters ............. 243 Security Issues: Result List ......... 186 Complete.............. 244 Severity levels ............ 186 Scan Scheduler ............. 244 Issue state: Open or Noise ........ 187 Schedule a new scan .......... 244 Resending tests............ 188 Edit scheduled scan configuration ..... 245 Right-click menu ........... 189 Delete a scheduled scan ......... 245 Filtering Security Issues in Result List .... 189 Schedule a Test stage only ........ 245 Sorting the Result List ......... 190 Schedule a scan in installments ...... 246 Security Issues: Detail Pane......... 190 Scheduled task command line parameters ... 247 Issue Information tab.......... 190 User-Defined Tests ........... 248 Advisory tab ............ 194 User-Defined Test wizard ........ 248 Fix Recommendations tab ........ 196 Test Type .............. 249 Request/Response tab ......... 197 Filter ............... 249 Report false positive test results ...... 199 Modification............. 250 Manual tests.............. 200 Validation ............. 251 Non-vulnerable variants .......... 203 Advisory .............. 251 Saving all non-vulnerable variants ..... 203 Completing the wizard ......... 251 Defining variants as non-vulnerable ..... 203 PowerTools .............. 251 Non-Vulnerable Variants List ....... 203 Authentication Tester .......... 251 Deleting variants ........... 204 Connection Test ........... 258 Encode/Decode ........... 260 Chapter 9. Results: Remediation Expression Test ............ 261 HTTP Request Editor.......... 262 Tasks ............... 205 Generic Service Client (GSC) ........ 266 Remediation Tasks: Application Tree...... 205 Customizing the Tools menu ........ 267 Remediation Tasks: Result List ....... 205 Adjust the order of the PowerTools ..... 267 Searching Remediation Tasks in Result List .. 206 Add programs to the Tools menu...... 267 Sorting Remediation Tasks ........ 207 Extensions .............. 268 Manipulating priority levels ....... 207 Extension Manager .......... 268 Deleting Remediation Tasks from the Result List 207 Pyscan .............. 269 Remediation Tasks: Detail Pane ....... 208 Explore Optimization module ....... 270 Logs ................ 274 Chapter 10. Reports ........ 209 Scan Log .............. 274 Report overview ............ 209 AppScan Log ............ 275 Configuring report layout ........ 209 Update Log ............. 275 iv IBM Security AppScan Standard: User Guide Traffic Log ............. 276 Advanced login troubleshooting workflow .. 308 Searching Results ............ 276 Long or never-ending Explore stage ...... 310 Flash movie troubleshooting ........ 310 Chapter 12. Integrations ....... 277 Some Flash movies are not scanned ..... 311 AppScan Enterprise ........... 277 Restore Adobe Flash Player settings ..... 313 Importing AppScan Enterprise license Multi-step operation troubleshooting ..... 313 permissions ............. 277 Replacing unsigned extensions ....... 314 Publishing to AppScan Enterprise ..... 278 Scan Log messages ........... 314 Creating a job in AppScan Enterprise .... 278 AppScan Log messages .......... 323 Creating a scan template in AppScan Enterprise 280 Flash Log messages ........... 329 Automation Frameworks ......... 280 Glass box troubleshooting ......... 330 Creating the batch command ....... 281 Application Security on Cloud ....... 282 Chapter 15. CLI .......... 331 Uploading to Application Security on Cloud 282 Command structure ........... 331 Commands .............. 331 Chapter 13. Best practices and FAQ 285 Exec command ............ 331 Workflow for advanced users ........ 285 Report command ........... 334 Initial Configuration .......... 287 Delta analysis report command ...... 336 Initial Automatic Explore ........ 288 Other commands ........... 336 Improve site coverage manually