Forest Global Training Partners

Cyber Risks · Qualys Blog

Building an App Sec Program with Qualys WAS - Configuring a Web Application or API: Crawl Settings | Qualys

Summary: Qualys published a walkthrough of crawl settings in its Web Application Scanning (WAS) product, describing four scope options: limit at or below the URL hostname, limit to a URL subdirectory, limit to the hostname plus a specified sub-domain, and limit to the hostname plus specified domains. The post also covers Explicit URLs for targeting pages not linked within the application, such as email-based registration links, and recommends starting with the default hostname-limited scope, with subdomains and external domains reported in the scan report and WAS Catalog.

Bottom line: Crawl scope decides what the scanner actually sees, so a scope set too narrowly leaves parts of the application untested while a scope set too broadly sends the scanner into domains you may not own. The post's own default - limit at or below the URL hostname - means subdomains and external domains surface only after the scan, in the report and WAS Catalog.

Read the original at Qualys Blog ↗

Topics
Vulnerabilities & Patching
Related