Web applications vs. web services

This topic explains the different methods available for exploring sites, before AppScan tests them.

A site is scanned by first exploring it, and then, based on the data gathered, testing it. "Explore data" can be gathered using one or more different Explore methods. In all cases, once the Explore data is gathered AppScan is used to create and send tests to the site during the Test stage.
Exploring web applications (sites with a user interface)
  • In the case of applications (sites) without web services it is often sufficient to supply AppScan with the start URL and login authentication credentials for it to be able to test the site.
  • Manual Explore: If necessary you can manually explore the site through AppScan,in order to get access to areas that can only be reached through specific user input.
  • Multi-Step Operations: For pages that can be reached only by accessing pages in a specific order, you can record a multi-step operation for AppScan to use.
While the Configuration Wizard lets you configure and start your scan in a few steps, for complex sites the Configuration Dialog Box lets you fine-tune and customize many more settings.
Exploring web services
There are three methods for doing this, the first is recommended.
  1. You can set up AppScan as a recording proxy for the device (such as a mobile phone or simulator) you use to explore the service. That way AppScan can analyze the Explore data collected, and send appropriate tests. You can also use AppScan to record traffic using external tool, such as a web services functional tester. See Using AppScan as recording proxy.
  2. If you have Open API description files (JSON or YAML) for your web service, you can use the Web Services Wizard extension to configure a scan, and the multi-step sequences needed to use the service. AppScan will then automatically scan the service.
  3. If you cannot use the first two methods, and have a WSDL file for your web service (such as a SOAP web service), the AppScan installation optionally includes a separate tool that lets users view the various methods incorporated in the web service, manipulate input data, and examine feedback from the service. You first need to give AppScan the URL of the service. The integrated "Generic Service Client" (GSC) uses the WSDL file to display the individual methods available in a tree format, and create a user-friendly GUI for sending requests to the service. You can use this interface to enter parameters and view the results. The process is "recorded" by AppScan and used to create tests for the service when AppScan scans the site. GSC can also be used as client for REST requests, without parsing a WSDL file, as a simple HTTP client. See Using GSC.
External client or device
In both the above cases, if you need to use an external device such as a mobile phone to explore the site, you can set up AppScan as proxy to follow your actions and then test the site based on the data.