Welcome
Welcome to the documentation for HCL AppScan Standard version 10.4.0
Getting started
This section provides a short tour of basic product features and procedures, including using the wizard to set up a scan.
Configuration
You configure a scan by choosing settings that best describe your application, and the kind of testing you want.
Manual exploring
Manual exploring enables you to explore specific parts of your application, filling in fields and forms as you go. This can be a way of ensuring that particular areas of the site are covered, and that AppScan has the information needed to complete forms correctly.
Scanning
Learn how to start a scan, and what happens during the scan; how to manually manipulate the Explore stage, and how to export the results of a scan.
Data
Data view is populated with information about the structure of the site during the Explore stage of the scan.
Issues
Issues view provides access to the results of a scan. You can view results at a high level or select specific tests or objects and access more details. These details include how to fix, requests/responses, and differences between the test variants that resulted in issues. You can manipulate the severity of issues, resend tests (with or without modifications), and create reports based on Issues.
Reports
This section describes how to generate reports from the scan results.
Tools
This section explains how to use additional tools provided with HCL AppScan Standard.
Integrations
This section describes integrations of other applications with AppScan Standard:
Best practices
This section contains some best practices and use cases for advanced users.
- Workflow for advanced users
  This workflow can help users with experience in the field of web security achieve a more thorough scan.
  - Initial Configuration
  - Initial Automatic Explore
    After your basic configuration, you can run an initial Automatic Explore to see how well AppScan covers the site at this stage.
  - Improve site coverage manually
    You can add URLs that the initial Automatic Explore stage missed, both individual URLs (such as those accessed by forms that require specific input) and ordered sequences of URLs (such as shopping carts).
  - Evaluate Explore results
    Before proceeding to the Test stage, review the Explore results, because if important areas of the site were missed during the Explore stage, they will not be tested during the Test stage.
  - Additional configuration
    Here are some configuration changes to consider if site coverage in the initial Explore stage was insufficient.
- Sites that use parameter-based navigation
  Sites in which all pages are reached using a single URL, need a specific scan configuration.
- Scanning live production environments
  The following risks and suggestions should be considered before scanning a live site with AppScan.
- Understanding Test Optimization
  This section describes how Test Optimization works and how best to incorporate it into your development lifecycle.
FAQ & Troubleshooting
CLI
This section describes the syntax and options available using the Command line interface.
References
Menus and toolbar summaries, and glossary

Initial Automatic Explore

After your basic configuration, you can run an initial Automatic Explore to see how well AppScan covers the site at this stage.

About this task

A full scan consists of both Explore and a Test stages, but for the moment run only an Explore stage.

Site coverage based on your initial configuration may be incomplete, but seeing which parts of the site are discovered and which are not can help you improve the configuration.

Procedure

Click Scan > Explore Only.
Let AppScan explore the site until it stops. During the scan you can see the Application tree and data fill in as the site is crawled.
Verify that the Explore stage finished successfully and did not terminate early due to AppScan being out-of-session.
Note: If it ended early because AppScan was out-of-session, re-record and reconfigure the login procedure, paying special attention to In-session detection and session ID tracking.
(Sites that use URL rewriting:) If your site uses URL rewriting, the Explore Optimization module can improve scan efficiency by eliminating unnecessary URLs from the Explore results at this stage.
1. Click Tools > Extensions > Explore Optimization: Run
2. If recommended by the module at the end of the process, click Scan > Re-Explore.
Attention: Do not perform this step unless you are sure your site uses URL rewriting.