Forest Global Training Partners

Cyber Risks · Qualys Blog

Building an App Sec Program with Qualys WAS - Additional Configurations and Review & Confirm | Qualys

Summary: Qualys published a walkthrough of the additional configuration options in its Web Application Scanning (WAS) tool, covering authentication records, header injection, API endpoint definition, exclusion lists, DNS overrides, redundant links, path fuzzing rules, form training, and malware monitoring. The article states WAS supports server, form, OAUTH2, and client-side certificate authentication, and can handle SSO and TOTP through Selenium scripts recorded with the Qualys Browser Recorder, but cannot automate 2FA or MFA other than TOTP.

Key Takeaway: The article notes that if a vulnerability scan identifies a vulnerability on any URL, the scanner will always retest it regardless of redundant link rules, and the only way to remove that prior vulnerability information is to purge and recreate the application. It also warns that API testing is limited to how complete the uploaded Postman or OAS/Swagger files are, so missing endpoints go untested.

Read the original at Qualys Blog ↗

Topics
Identity & Access Management
Related