Test Options view

Test Options:

Use Adaptive Testing

AppScan can send many thousands of tests to a site. However, in order to reduce scan time, it can send preliminary tests that intelligently determine which are the appropriate tests to send and which can be dispensed with. This is "Adaptive Testing" and it can greatly reduce scan time, without sacrificing efficiency.

Clear this check box if you want AppScan® to send all its tests to the site.

Allow Multiphase Scanning

AppScan analyzes responses to the tests that it sends your application. From this analysis, AppScan® frequently discovers additional content, such as links that were invisible on the first "phase" of the scan. Multiphase scanning enables AppScan to repeat the Explore and Test stages on this newly detected content. (The additional phase is usually shorter, as it involves the new links only.)

Multiphase Scanning is configured by default to allow a maximum of 4 scan phases.

Note that multiphase scanning applies only when you run a Full Scan. If you use the Explore Only and Test Only functions, the result will be a single-phase scan.

Send Tests on Login and Logout pages

It is recommended to allow AppScan to test login and logout pages, unless your application locks out users who provide illegal input, or the application flow would be altered by AppScan® testing these pages.

Do not send session identifiers when testing login pages

(Active only if previous check box is selected.) It is recommended to leave this check box selected, since session identifiers could limit test success when testing login pages. Clear it only if you are sure that valid session tokens are necessary to test your login pages.

Note that even when this check box is selected, some tests are still sent with session identifiers, to prevent false positive results.

Analyze results for inadvertently-triggered issues

When selected, AppScan® analyzes each test response for additional security issues over-and-above the specific issue tested for. Deselect this option if the application is very large, or if scans produce a large number of false-positive results.

Include all variants of each issue

(Active only if previous check box is selected.) When selected, AppScan analyzes all variants of each inadvertently-triggered issue; when deselected, only one variant per issue is analyzed. Selecting this check box is not usually necessary, and can significantly increase scan time.

Save Non-Vulnerable Test Variant Information

During a scan, AppScan sends many thousands of test variants to the site it is testing. The responses to many of these indicate that they do not pose a security threat of any kind, and by default AppScan® discards all these "non-vulnerable" results, considerably reducing the volume of the result data.

If you select this check box AppScan will save all non-vulnerable variants. A warning will appear this option may reduce AppScan® performance and significantly increase the disk space required.

For more details see Non-vulnerable variants