Integrating custom scripts in AppScan for enhanced DAST scanning

1. Go to Tools > Options > Advanced tab.
2. Set the CustomScripts.Enable setting to "False".

1. Select Custom scripts from the Advanced section in the configuration settings.
2. Click the + Add button.
3. Edit the prepopulated Name field as necessary.
4. Choose the appropriate Execution context for your script: :
   1. Before requestfor scripts to run before sending requests.
   2. After response for scripts to run after receiving responses.
   3. Parameter for tasks that involve multiple-steps or filling out forms. You can use this context in conjuction with the setResultValue method to allow scripts to return results to AppScan.
5. Enter your JavaScript in the JavaScript field (code-editor) and use Ctrl+Space for auto-complete suggestions within the AppScan environment.

   Verify your script for syntax accuracy and compatibility with the supported JavaScript version in AppScan. For detailed guidelines, refer to JavaScript code.

   Tip: Syntax errors are highlighted within the code editor and can be identified by tooltips, although they do not prevent script execution.

   

   Example 1: Automatically add login details to your requests (without using Login Management configuration).

   // Before each request
   if(request.method == "POST") {
       request.body = JSON.stringify({
           "username": "jsmith",
           "password": "demo1234"
       })
   }

   Example 2: Store API keys from responses in global variables.

   // After each response
   try {
           var result = JSON.parse(response.body)
           log(`parsing: ${JSON.parse(response.body).Authorization}`)
           if(result.Authorization) {
               environment.globalVariables.addOrUpdate("Authorization", result.Authorization)
               log(`key = ${result.Authorization}`)
           }
   }
   catch (error) {
           log(error)
   }

   Example 3: Append the authorization API key to the header if it exists.

   // Before each request
   var authorization = environment.globalVariables.get("Authorization")
       if(authorization) {
           request.headers.set("Authorization", authorization)
           log(`authorization is ${authorization}`)
       }    

   Example 4: Add another header with a different value.

   // Before each request
   function addUniqueHeader(headerName, value) {
       if(!(request.headers[headerName] != null && request.headers[headerName].includes(value))) {
           request.headers.add(headerName, value)
           }
   }
   addUniqueHeader(“headerName”,”Value”)   

6. Click Add to save your script. The script is added to the list and enabled by default.
   Note: These scripts are executed for each HTTP request or response during the DAST scan.
   Use this feature wisely to enhance the efficiency and effectiveness of your scans. Test your scripts in a controlled environment before live deployment to ensure they function as expected.
7. You can choose to enable or disable a script from the list of custom scripts using the Enable checkbox.
8. Manage your scripts using the Enable checkbox or by editing, deleting, or reordering them in the script list.
9. Click Start full scan to run the scan.
10. Result: The enabled scripts are executed for each request or response. You can view the details of the scripts from Data > Requests tab > Request/Response.
    Note: Custom scripts are encrypted by default when exported in a template. To disable encryption, adjust the General: Encrypt sensitive data setting to False in the scan configuration.

1. Body: Holds the response body from the response. The response is in string format, so you need to convert it manually if needed (to JSON for example). This property is read-only; it remains the same even if you attempt to change it before running the script.

   // Access body
   response.body

   // Example
   let json = JSON.parse(config.response)

2. Path: Contains the information about the response endpoint.

   // Access to the relative url
   response.path

   // Example
   if (response.path.startsWith("api/v1/test"))

3. Status: Stores details about the response status. The status is an object with the following properties:

   // Access status
   response.status.statusCode // A numeric representation of the status
   response.status.statusDescription // The description of the status code
   response.status.statusLine //the whole status line including the http version

   // Example
   if (response.status.statusCode == 200) // check only the number
   if (response.status.statusDescription == "OK") // Check only the description
   if (response.status.statusLine == "HTTP1.1 200 OK") // Full line

4. Headers: Contains all the response headers. You can add, remove or modify any header except the default headers.

   // Add header
   response.headers.add(key, value)

   // Override header if exist
   response.headers.set(key, value)

   // Remove header
   response.headers.remove(key)

   // Modify header
   response.headers[key]

   // Examples
   response.headers.add("Authorization", "MyCoolApiKey")
   response.headers.set("Authorization", "SecondApiKey")
   response.headers.remove("Authorization")
   response.headers['Authorization'] = "myapikey3"

5. ParentRequest: An object that contains the request that was sent prior to the response. The request data is read-only. The request has all the properties as the previously defined request object.

   // Example
   response.request.path //- access to the path from the request

1. Global variables: The global variables data is a key-value data structure designed to store user-specific data pairs. The keys are unique (meaning no two elements can have the same key, though multiple elements can share the same value), which is useful for sharing data between running scripts.

   This data is erased every time a new scan or rescan is done.

   // Add data to the globals or update existing one
   environment.globalVariables.addOrUpdate(key, value)

   // Remove key data from the globals
   environment.globalVariables.remove(key)

   // Read data - retrieves the value for the current key (without removing it)
   environment.globalVariables.get(key)

2. Scan status: Contains information about the current scan.

   // determine if the current phase is explore phase
   environment.status.isInExplore()

   // determine if the current phase is test phase
   environment.status.isInTest()

// Log message to file
log("my cool logging")

// Log message with custom source
log("message", "my-cool-source")

// Sets the script execution result
setResultValue("result")

• ES6 (2015)
  • Generators
  • Tail calls
• ES8 (2017)
  • Shared memory and atomics
• ES15 (2024)
  • Atomics.waitAsync
  • Regular expression flag \v