Attack Configuration Structure Reference

The attack class. Valid values are:

• Application Developer
• Server Administrator
• Database Administrator
• Best Practice
• Privacy
• Reflection
• External Active Content

Default severity of the vulnerabilities found by this attack. The valid values are:

• Safe
• Informational
• Low
• Medium
• High

Tells that AppSpider should use this attack to only attack parameters with the specified parameter value types. Valid values are:

• UnknownInputType
• Base64
• Base64MS
• DateYMD
• DateMDY
• DateDMY
• Digit
• EpochTime
• PathFile
• HashMD5
• Url
• UserPassWord
• Alpha
• AlphaNumeric
• AllTypes

Note that multiple values can be set. To set multiple values, the values should be separated by ‘|’ character, as follows:

Base64 | UserPassWord | AlphaNumeric

Tells AppSpider whether or not to perform parameter analysis. Valid values are:

• No Analysis Requirements
• Injected Reflecting Parameter
• Controlling Parameter

Note that multiple values can be set. To set multiple values, the values should be separated by ‘|’ character, as follows:

Injected Reflecting Parameter | Controlling Parameter

Notes:

1. The default value is the combination of “Injected Reflecting Parameter” and “Controlling Parameter.” Currently, there is no functional difference between these two values. Specifying either or both will result in full parameter analysis being performed. At present, then, this is a boolean flag.
2. For custom modules, this value should be set to “No Analysis Requirements” unless either:

1. AttackControllingParameterOnly is set to 1 (true), or
2. ParameterValueTypes has a value other than either UnknownInputType or AllTypes.

In the cases where parameter analysis is necessary as noted, the attack execution will depend on the results of the parameter analysis. For example, if the attack is only for controlling parameters, the attack will only be run for parameters that have been found by parameter analysis to be controlling parameters. In this situation, the AnalysisRequirements value must be set accordingly to ensure that the analysis is actually performed.

If the attack requires analysis, but analysis is never performed, then no parameters will meet the criteria, and the attack will never be run. Conversely, if the attack does not require parameter analysis, then AnalysisRequirements should be set to “No Analysis Requirements” to avoid unnecessary time-consuming analysis.

Ids of the vulnerability type according the various standards.

Determines how parameter values should be encoded.

Valid values are:

• No Encoding
• Percent Encoding

Note that multiple values can be set. To set multiple values, the values should be separated by ‘|’ character, as follows:

No Encoding | Percent Encoding

Describes the attack point for which this attack should be invoked. Valid values are:

• Web Site
• Directory
• File
• Web Resource
• Parameter
• Response Analysis

Note that multiple values can be set. To set multiple values, the values should be separated by ‘|’ character, as follows:

Web Site | Directory | Parameter

N.B. The “Web Resource” string here correlates to the CrawlResult attack point in the API.

Describes parameter locations that should be attacked with this attack. Valid values are:

• Directory
• File
• Path
• Query
• Fragment
• Post
• Http Header
• Cookie
• Referer

Note that multiple values can be set. To set multiple values, the values should be separated by ‘|’ character, as follows:

Query | Post | Cookie

For passive attacks only. If set to 1, the attack will be scheduled to run later in the scan (as though it is an active attack) instead of running immediately during crawl (default value is 0).

Depending on where link was found, it can be attackable by this attack or not. This element specified what links should be attacked based on where they were found.

Valid values are:

• HTML
• Form
• AJAX
• Flash
• Silverlight
• WSDL

Note that multiple values can be set. To set multiple values, the values should be separated by ‘|’ character, as follows:

Flash | Silverlight

List of parameters that can be used to parameterize attack behavior. Attack module has access to those parameter during attack execution. The names and format of the parameters are defined by module writers.

See “Access to configuration and custom parameters” for an example parameter.