Advanced Scan Configuration

There are several ways to create or edit a Scan Configuration.

Edit the options in the AppSpider user interface.
Edit the options under Advanced options in the user interface.
Download and edit the Scan Configuration XML file.

In this article we will go over accessing the advanced options within AppSpider and using the Scan configuration file.

Advanced options settings

The panel allows you to configure the advanced options. You may sort the settings by name, value, or description.

This panel contains the same information located in the Scan configuration XML file.

Scan configuration XML file

You can edit an existing scan configuration file or provide a new custom file.

File structure

The Scan Configuration file is an XML file and has a hierarchical structure. The top-level data structure in the file is ScanConfig. Everything else in the file resides below ScanConfig in the hierarchy.

There are 3 types of elements in the Scan configuration file:

Scalar - Options that have a single value. For example, ScanName.
Composite Object - An object that can contain other heterogeneous elements such as Scalars, Composite Objects and Lists. For example, the top-level object in the Scan Configuration file, the ScanConfig object is a Composite Object.
List - Options that can have a list of values. Lists cannot contain other Lists directly.

Scalar types

Scalar values in the Scan configuration file can be of 1 of the following types:

String - A String type.
LargeString - A String type optimized for large strings
UniqueString - A string type optimized for string that most likely be repeated multiple times.
LargeUniqueString - A string type optimized for large strings that a likely to be repeated multiple times.
LargeCompressedString - A string type that store strings in compressed form.
ByteNumber - A one-byte number
WordNumber - A two-byte number
Number - A four-byte number
LargeNumber - An eight-byte number
Enumeration - A data type consisted on named predefined values.
Float - A four-byte floating point number
Double - An eight-byte floating point number
Boolean - A boolean type. Boolean is not an enumerated type; it is stored as a Number with values either 0 or 1.
- 1 = TRUE
- 0 = FALSE
Date - Store Date data. It is stored in the format YYYY-MM-DD HH:MM:SS
Duration - Store time duration data. It is stored in the format [DD Day[s]] HH:MM::SS, where DD is the number of days, and square brackets show optional elements.

Enumerated types

Many Scalar elements in the Scan configuration file have Enumeration types. Enumeration type is stored as an integer but allows a user to reference integer values by their symbolic name. An enumerated type value can be set using either its numeric or symbolic form. For example, the following 2 lines from Scan configuration file are equivalent because 'High' is enumerated value defines as '4'.


xml
1
      <Severity>High</Severity>
2
      <Severity>4</Severity>

Bitmasks

Some Enumerated Types can be BitMasks, where the value of an element is defined by several bits. Enumerated values of BitMasks are defined so they do not have same bit set and can be used in a bitwise-OR operation to produce the final value. Multiple bits that are set in the bitmask are separated with character '|' for example:


xml
1
<AttackPoints>Directory|File|Parameter</AttackPoints>

For Enumerated Types, the values of the Bitmasks can be set using either numeric or symbolic form. The following 2 lines below are equivalent because value Parameter is defined as 16.


xml
1
  <AttackPoints>Directory|File|Parameter</AttackPoints>
2
  <AttackPoints>Directory|File|16</AttackPoints>

Default values

When a new Scan configuration file is created all Scalar Elements are assigned their default values. Default values are configured so that they produce best results for majority of web sites. Even if an element is not present in the Scan configuration file AppSpider will use the default value of the element.

Scan configuration schema changes

AppSpider development is an ongoing process. Developers frequently come across new types of web sites that require some special treatment and require new ways of configuring a scan execution. As a result, the number of parameters in the Scan configuration increases with every major release of AppSpider. To avoid any problems with Scan Configuration files created by the previous versions of AppSpider or by user's programs only new elements are added to the scan configuration files and all existing elements and their meaning are preserved.

XML file example

When you create or export a ScanConfig file it generated a file with the objects and fields.

To get more information on what is in each object see Scan Configuration Parameters.

XML File example


xml
1
<?xml version="1.0"?>
2
<ScanConfig>
3
  <Name>webscantest</Name>
4
  <AppVersion>7.0</AppVersion>
5
  <Log>1</Log>
6
  <DetailedLogging>0</DetailedLogging>
7
  <IncludeTraffic>0</IncludeTraffic>
8
  <WindowsErrors>0</WindowsErrors>
9
  <UseSystemDsn>0</UseSystemDsn>
10
  <Recrawl>0</Recrawl>
11
  <PauseOnRecoverableError>1</PauseOnRecoverableError>
12
  <ExecuteCommandLineURL></ExecuteCommandLineURL>
13
  <NotifyScanDoneURL></NotifyScanDoneURL>
14
  <JavaScriptEngine>Chrome</JavaScriptEngine>
15
  <MaxDatabaseSize>1073741824</MaxDatabaseSize>
16
  <MaxTrafficFiles>0</MaxTrafficFiles>
17
  <CrawlConfig>
18
    <MaxDomain>100</MaxDomain>
19
    <MaxCrawlResults>5000</MaxCrawlResults>
20
    <MaxPerWebSiteCrawlResults>-1</MaxPerWebSiteCrawlResults>
21
    <MaxPerDirCrawlResults>500</MaxPerDirCrawlResults>
22
    <MaxPerLinkCrawlResults>50</MaxPerLinkCrawlResults>
23
    <MaxPerNormalizedLinkCrawlResult>100</MaxPerNormalizedLinkCrawlResult>
24
    <MaxPerDirChildNodes>300</MaxPerDirChildNodes>
25
    <MaxBlackListExtCrawlResults>100</MaxBlackListExtCrawlResults>
26
    <MaxAttackFeedbackLinksCount>300</MaxAttackFeedbackLinksCount>
27
    <MaxPerFileNameCrawlResults>250</MaxPerFileNameCrawlResults>
28
    <MaxPerQueryCrawlResults>400</MaxPerQueryCrawlResults>
29
    <RecursionDepth>2</RecursionDepth>
30
    <MaxDirDepth>15</MaxDirDepth>
31
    <DiscoveryDepth>-1</DiscoveryDepth>
32
    <UrlRepetitionTolerance>25</UrlRepetitionTolerance>
33
    <SequenceRepetitionTolerance>5</SequenceRepetitionTolerance>
34
    <MaxReportedImages>500</MaxReportedImages>
35
    <MaxReportedLinks>2500</MaxReportedLinks>
36
    <MaxReportedComments>500</MaxReportedComments>
37
    <MaxReportedScripts>500</MaxReportedScripts>
38
    <MaxReportedEmails>500</MaxReportedEmails>
39
    <MaxReportedForms>500</MaxReportedForms>
40
    <MaxBrowserPageWaitTimeout>60000</MaxBrowserPageWaitTimeout>
41
    <MaxBrowserWaitTillRequestTimeout>4000</MaxBrowserWaitTillRequestTimeout>
42
    <MaxBrowserDOMDepth>4</MaxBrowserDOMDepth>
43
    <MaxBrowserEventsPerLink>600</MaxBrowserEventsPerLink>
44
    <MaxBrowserEventsPerCrawlResult>400</MaxBrowserEventsPerCrawlResult>
45
    <MaxBrowserEventsPerDOM>100</MaxBrowserEventsPerDOM>
46
    <MaxBrowserNoNewResourceDOMCount>400</MaxBrowserNoNewResourceDOMCount>
47
    <NotInsertedLinkCountThreshold>2</NotInsertedLinkCountThreshold>
48
    <MaxCookiesFromJavascript>100</MaxCookiesFromJavascript>
49
    <MaxCookiesSameNameFromJavascript>10</MaxCookiesSameNameFromJavascript>
50
    <MaxDaysThresholdGoodTraffic>7</MaxDaysThresholdGoodTraffic>
51
    <CrawlPrioritization>Smart</CrawlPrioritization>
52
    <FileNotFoundRegex>(page|resource) (you requested )?(was not|cannot be) found|Page not found|404(.0)? - ((File (or directory )?not found)|(Not Found))|HTTP Status 404|404 Not Found</FileNotFoundRegex>
53
    <ServerErrorRegex></ServerErrorRegex>
54
    <InvalidURLRegexAttack><![CDATA[['"\(\)<>]|\d([-+]|%2[bd])\d|repeat\(|alert\(|/x\w{7}\.txt|window.location|%20(AND|OR)%20|%3cscript|(ping|echo)%20|javascript(%3a|:)|%0d%0a]]></InvalidURLRegexAttack>
55
    <InvalidURLRegexCrawl><![CDATA[(([ ]|%20)(MOD|ASC|DESC)([ ]|%20)|(<|%3c)(a|div|script|style|iframe|img|svg)|[?&=]x[a-z0-9]{7}$|C=N;O=D|\?C=M)|(ping|echo)%20|javascript(%3a|:)|%0d%0ax]]></InvalidURLRegexCrawl>
56
    <PriorityLinksRegex>(auth|log[ -]?(in|on)|sign[ -]?(in|on)|profile|account|transfer|admin)</PriorityLinksRegex>
57
    <LockCookies>0</LockCookies>
58
    <CaseSensitivity>Case Sensitive</CaseSensitivity>
59
    <UniqueUrlsAcrossWebsites>0</UniqueUrlsAcrossWebsites>
60
    <SaveReferences>0</SaveReferences>
61
    <UseBrowser>1</UseBrowser>
62
    <ShowBrowser>0</ShowBrowser>
63
    <StayOnPort>0</StayOnPort>
64
    <RestrictToMacro>0</RestrictToMacro>
65
    <RestrictToManualCrawling>0</RestrictToManualCrawling>
66
    <RestrictToSeedList>0</RestrictToSeedList>
67
    <RestrictToWebService>0</RestrictToWebService>
68
    <RestrictToSelenium>0</RestrictToSelenium>
69
    <RestrictToSwagger>0</RestrictToSwagger>
70
    <ImportCookiesFromTraffic>0</ImportCookiesFromTraffic>
71
    <PageEqualThreshhold>0.95</PageEqualThreshhold>
72
    <PageSimilarThreshhold>0.8</PageSimilarThreshhold>
73
    <ExperimentalCrawling>Disabled</ExperimentalCrawling>
74
    <Flash>1</Flash>
75
    <EnableAdvancedParsers>1</EnableAdvancedParsers>
76
    <SearchForUrls>1</SearchForUrls>
77
    <CookieCommaSeparator>1</CookieCommaSeparator>
78
    <MaxWebResourcesOverhead>1000</MaxWebResourcesOverhead>
79
    <BlacklistContactForms>0</BlacklistContactForms>
80
    <FrameworksCrawlConfig>
81
      <EnableFrameworksCrawling>1</EnableFrameworksCrawling>
82
      <FrameworkConfigList>
83
        <FrameworkConfig>
84
          <Name>ReactJS</Name>
85
          <DefaultConfigVersion>2</DefaultConfigVersion>
86
          <Enabled>1</Enabled>
87
          <HEAD>1</HEAD>
88
          <DetectionRegex>createReactRootIndex</DetectionRegex>
89
          <HealthcheckString>react</HealthcheckString>
90
          <FileName>fm.react.min.js</FileName>
91
          <GetAllEventsScript>window.fm.react.getAllEvents('appspider');</GetAllEventsScript>
92
          <GetAllEventsDelay>0</GetAllEventsDelay>
93
          <GetVersionStringScript></GetVersionStringScript>
94
        </FrameworkConfig>
95
        <FrameworkConfig>
96
          <Name>AngularJS</Name>
97
          <DefaultConfigVersion>1</DefaultConfigVersion>
98
          <Enabled>1</Enabled>
99
          <HEAD>0</HEAD>
100
          <DetectionRegex>ng-controller</DetectionRegex>
101
          <HealthcheckString>angular</HealthcheckString>
102
          <FileName>angular-hook-bundle.min.js</FileName>
103
          <GetAllEventsScript>NG_HOOK.getAllNgEvents();</GetAllEventsScript>
104
          <GetAllEventsDelay>0</GetAllEventsDelay>
105
          <GetVersionStringScript>NG_HOOK.getVersionString();</GetVersionStringScript>
106
        </FrameworkConfig>
107
        <FrameworkConfig>
108
          <Name>KnockoutJS</Name>
109
          <DefaultConfigVersion>1</DefaultConfigVersion>
110
          <Enabled>1</Enabled>
111
          <HEAD>0</HEAD>
112
          <DetectionRegex>data-bind</DetectionRegex>
113
          <HealthcheckString>ko</HealthcheckString>
114
          <FileName>ko-hook-bundle.min.js</FileName>
115
          <GetAllEventsScript>KO_HOOK.getAllKOEvents();</GetAllEventsScript>
116
          <GetAllEventsDelay>5000</GetAllEventsDelay>
117
          <GetVersionStringScript>KO_HOOK.getVersionString();</GetVersionStringScript>
118
        </FrameworkConfig>
119
        <FrameworkConfig>
120
          <Name>AngularLib</Name>
121
          <DefaultConfigVersion>2</DefaultConfigVersion>
122
          <Enabled>1</Enabled>
123
          <HEAD>0</HEAD>
124
          <DetectionRegex>(?-i)angular(?!\w)</DetectionRegex>
125
          <HealthcheckString></HealthcheckString>
126
          <FileName>angular-4-hook-bundle.min.js</FileName>
127
          <GetAllEventsScript>NG_HOOK_LIB.getAllAngularFmEvents();</GetAllEventsScript>
128
          <GetAllEventsDelay>5000</GetAllEventsDelay>
129
          <GetVersionStringScript>NG_HOOK_LIB.getVersionString();</GetVersionStringScript>
130
        </FrameworkConfig>
131
        <FrameworkConfig>
132
          <Name>ReactLib</Name>
133
          <DefaultConfigVersion>1</DefaultConfigVersion>
134
          <Enabled>1</Enabled>
135
          <HEAD>0</HEAD>
136
          <DetectionRegex>react-text</DetectionRegex>
137
          <HealthcheckString></HealthcheckString>
138
          <FileName>react-hook-bundle.min.js</FileName>
139
          <GetAllEventsScript>REACT_HOOK_LIB.getAllReactEvents();</GetAllEventsScript>
140
          <GetAllEventsDelay>5000</GetAllEventsDelay>
141
          <GetVersionStringScript>REACT_HOOK_LIB.getVersionString();</GetVersionStringScript>
142
        </FrameworkConfig>
143
        <FrameworkConfig>
144
          <Name>ReactTwo</Name>
145
          <DefaultConfigVersion>1</DefaultConfigVersion>
146
          <Enabled>1</Enabled>
147
          <HEAD>0</HEAD>
148
          <DetectionRegex>(?-i)"react[.][a-df-z][a-z]+"</DetectionRegex>
149
          <HealthcheckString></HealthcheckString>
150
          <FileName>react-hook-bundle.min.js</FileName>
151
          <GetAllEventsScript>REACT_HOOK_LIB.getAllReactTwoEvents();</GetAllEventsScript>
152
          <GetAllEventsDelay>5000</GetAllEventsDelay>
153
          <GetVersionStringScript>REACT_HOOK_LIB.getVersionString();</GetVersionStringScript>
154
        </FrameworkConfig>
155
        <FrameworkConfig>
156
          <Name>OpenUI5</Name>
157
          <DefaultConfigVersion>1</DefaultConfigVersion>
158
          <Enabled>1</Enabled>
159
          <HEAD>0</HEAD>
160
          <DetectionRegex>(?-i)sap-ui-debug</DetectionRegex>
161
          <HealthcheckString></HealthcheckString>
162
          <FileName>sap-open-ui5-hook-bundle.min.js</FileName>
163
          <GetAllEventsScript>OPEN_UI5_HOOK_LIB.getAllOPENUI5Events();</GetAllEventsScript>
164
          <GetAllEventsDelay>5000</GetAllEventsDelay>
165
          <GetVersionStringScript>OPEN_UI5_HOOK_LIB.getVersionString();</GetVersionStringScript>
166
        </FrameworkConfig>
167
        <FrameworkConfig>
168
          <Name>Vue</Name>
169
          <DefaultConfigVersion>1</DefaultConfigVersion>
170
          <Enabled>1</Enabled>
171
          <HEAD>0</HEAD>
172
          <DetectionRegex>(?-i)__VUE_SSR_CONTEXT__</DetectionRegex>
173
          <HealthcheckString></HealthcheckString>
174
          <FileName>vue-hook-bundle.min.js</FileName>
175
          <GetAllEventsScript>VUE_HOOK_LIB.getAllVueEvents();</GetAllEventsScript>
176
          <GetAllEventsDelay>5000</GetAllEventsDelay>
177
          <GetVersionStringScript>VUE_HOOK_LIB.getVersionString();</GetVersionStringScript>
178
        </FrameworkConfig>
179
        <FrameworkConfig>
180
          <Name>Ember</Name>
181
          <DefaultConfigVersion>1</DefaultConfigVersion>
182
          <Enabled>1</Enabled>
183
          <HEAD>0</HEAD>
184
          <DetectionRegex>(?-i)EMBER_LOAD_HOOKS</DetectionRegex>
185
          <HealthcheckString></HealthcheckString>
186
          <FileName>ember-hook-bundle.min.js</FileName>
187
          <GetAllEventsScript>EMBER_HOOK_LIB.getAllEmberEvents();</GetAllEventsScript>
188
          <GetAllEventsDelay>5000</GetAllEventsDelay>
189
          <GetVersionStringScript>EMBER_HOOK_LIB.getVersionString();</GetVersionStringScript>
190
        </FrameworkConfig>
191
        <FrameworkConfig>
192
          <Name>Backbone</Name>
193
          <DefaultConfigVersion>1</DefaultConfigVersion>
194
          <Enabled>1</Enabled>
195
          <HEAD>0</HEAD>
196
          <DetectionRegex>(?-i)Backbone</DetectionRegex>
197
          <HealthcheckString></HealthcheckString>
198
          <FileName>backbone-hook-bundle.min.js</FileName>
199
          <GetAllEventsScript>BACKBONE_HOOK_LIB.getAllBackboneEvents();</GetAllEventsScript>
200
          <GetAllEventsDelay>5000</GetAllEventsDelay>
201
          <GetVersionStringScript>BACKBONE_HOOK_LIB.getVersionString();</GetVersionStringScript>
202
        </FrameworkConfig>
203
      </FrameworkConfigList>
204
    </FrameworksCrawlConfig>
205
    <SeedUrlList>
206
      <SeedUrl>
207
        <Value>http://www.webscantest.com/</Value>
208
      </SeedUrl>
209
    </SeedUrlList>
210
    <ScopeConstraintList>
211
      <ScopeConstraint>
212
        <URL>http://www.webscantest.com/*</URL>
213
        <Method>All</Method>
214
        <MatchCriteria>Wildcard</MatchCriteria>
215
        <Exclusion>Include</Exclusion>
216
      </ScopeConstraint>
217
      <ScopeConstraint>
218
        <URL>http://*.www.webscantest.com/*</URL>
219
        <Method>All</Method>
220
        <MatchCriteria>Wildcard</MatchCriteria>
221
        <Exclusion>Include</Exclusion>
222
      </ScopeConstraint>
223
    </ScopeConstraintList>
224
    <BlackListExtensionList>
225
      <BlackListExtension>
226
        <Value>css</Value>
227
      </BlackListExtension>
228
      <BlackListExtension>
229
        <Value>axd</Value>
230
      </BlackListExtension>
231
    </BlackListExtensionList>
232
    <GrayListExtensionList>
233
      <GrayListExtension>
234
        <Value>pdf</Value>
235
      </GrayListExtension>
236
      <GrayListExtension>
237
        <Value>doc</Value>
238
      </GrayListExtension>
239
      <GrayListExtension>
240
        <Value>jpg</Value>
241
      </GrayListExtension>
242
      <GrayListExtension>
243
        <Value>jpeg</Value>
244
      </GrayListExtension>
245
      <GrayListExtension>
246
        <Value>gif</Value>
247
      </GrayListExtension>
248
      <GrayListExtension>
249
        <Value>png</Value>
250
      </GrayListExtension>
251
      <GrayListExtension>
252
        <Value>bmp</Value>
253
      </GrayListExtension>
254
      <GrayListExtension>
255
        <Value>ico</Value>
256
      </GrayListExtension>
257
      <GrayListExtension>
258
        <Value>js</Value>
259
      </GrayListExtension>
260
      <GrayListExtension>
261
        <Value>tiff</Value>
262
      </GrayListExtension>
263
      <GrayListExtension>
264
        <Value>eot</Value>
265
      </GrayListExtension>
266
      <GrayListExtension>
267
        <Value>ttf</Value>
268
      </GrayListExtension>
269
      <GrayListExtension>
270
        <Value>mid</Value>
271
      </GrayListExtension>
272
      <GrayListExtension>
273
        <Value>midi</Value>
274
      </GrayListExtension>
275
      <GrayListExtension>
276
        <Value>mp3</Value>
277
      </GrayListExtension>
278
      <GrayListExtension>
279
        <Value>mpeg</Value>
280
      </GrayListExtension>
281
      <GrayListExtension>
282
        <Value>wav</Value>
283
      </GrayListExtension>
284
      <GrayListExtension>
285
        <Value>avi</Value>
286
      </GrayListExtension>
287
      <GrayListExtension>
288
        <Value>woff</Value>
289
      </GrayListExtension>
290
      <GrayListExtension>
291
        <Value>svg</Value>
292
      </GrayListExtension>
293
    </GrayListExtensionList>
294
    <BinaryExtensionList>
295
      <BinaryExtension>
296
        <Value>fla</Value>
297
      </BinaryExtension>
298
      <BinaryExtension>
299
        <Value>swf</Value>
300
      </BinaryExtension>
301
      <BinaryExtension>
302
        <Value>pdf</Value>
303
      </BinaryExtension>
304
      <BinaryExtension>
305
        <Value>doc</Value>
306
      </BinaryExtension>
307
      <BinaryExtension>
308
        <Value>jpg</Value>
309
      </BinaryExtension>
310
      <BinaryExtension>
311
        <Value>jpeg</Value>
312
      </BinaryExtension>
313
      <BinaryExtension>
314
        <Value>gif</Value>
315
      </BinaryExtension>
316
      <BinaryExtension>
317
        <Value>png</Value>
318
      </BinaryExtension>
319
      <BinaryExtension>
320
        <Value>bmp</Value>
321
      </BinaryExtension>
322
      <BinaryExtension>
323
        <Value>ico</Value>
324
      </BinaryExtension>
325
      <BinaryExtension>
326
        <Value>dll</Value>
327
      </BinaryExtension>
328
      <BinaryExtension>
329
        <Value>exe</Value>
330
      </BinaryExtension>
331
      <BinaryExtension>
332
        <Value>eot</Value>
333
      </BinaryExtension>
334
      <BinaryExtension>
335
        <Value>ttf</Value>
336
      </BinaryExtension>
337
      <BinaryExtension>
338
        <Value>mp3</Value>
339
      </BinaryExtension>
340
      <BinaryExtension>
341
        <Value>mp4</Value>
342
      </BinaryExtension>
343
      <BinaryExtension>
344
        <Value>wav</Value>
345
      </BinaryExtension>
346
      <BinaryExtension>
347
        <Value>woff</Value>
348
      </BinaryExtension>
349
      <BinaryExtension>
350
        <Value>svg</Value>
351
      </BinaryExtension>
352
    </BinaryExtensionList>
353
    <TextExtensionList>
354
      <TextExtension>
355
        <Value>txt</Value>
356
      </TextExtension>
357
      <TextExtension>
358
        <Value>js</Value>
359
      </TextExtension>
360
      <TextExtension>
361
        <Value>css</Value>
362
      </TextExtension>
363
      <TextExtension>
364
        <Value>json</Value>
365
      </TextExtension>
366
    </TextExtensionList>
367
    <BinaryContentTypeList>
368
      <BinaryContentType>
369
        <Value>audio/*</Value>
370
      </BinaryContentType>
371
      <BinaryContentType>
372
        <Value>image/*</Value>
373
      </BinaryContentType>
374
      <BinaryContentType>
375
        <Value>video/*</Value>
376
      </BinaryContentType>
377
      <BinaryContentType>
378
        <Value>application/pdf</Value>
379
      </BinaryContentType>
380
      <BinaryContentType>
381
        <Value>application/zip</Value>
382
      </BinaryContentType>
383
      <BinaryContentType>
384
        <Value>application/x-rar-compressed</Value>
385
      </BinaryContentType>
386
      <BinaryContentType>
387
        <Value>application/x-dvi</Value>
388
      </BinaryContentType>
389
      <BinaryContentType>
390
        <Value>application/x-shockwave-flash</Value>
391
      </BinaryContentType>
392
      <BinaryContentType>
393
        <Value>application/msword</Value>
394
      </BinaryContentType>
395
      <BinaryContentType>
396
        <Value>application/ogg</Value>
397
      </BinaryContentType>
398
      <BinaryContentType>
399
        <Value>application/x-tar</Value>
400
      </BinaryContentType>
401
      <BinaryContentType>
402
        <Value>application/octet-stream</Value>
403
      </BinaryContentType>
404
    </BinaryContentTypeList>
405
    <HTMLContentTypeList>
406
      <HTMLContentType>
407
        <Value>text/html</Value>
408
      </HTMLContentType>
409
      <HTMLContentType>
410
        <Value>html/*</Value>
411
      </HTMLContentType>
412
      <HTMLContentType>
413
        <Value>application/xhtml+xml</Value>
414
      </HTMLContentType>
415
    </HTMLContentTypeList>
416
    <TextContentTypeList>
417
      <TextContentType>
418
        <Value>text/plain</Value>
419
      </TextContentType>
420
      <TextContentType>
421
        <Value>text/csv</Value>
422
      </TextContentType>
423
      <TextContentType>
424
        <Value>text/css</Value>
425
      </TextContentType>
426
      <TextContentType>
427
        <Value>text/javascript</Value>
428
      </TextContentType>
429
      <TextContentType>
430
        <Value>application/javascript</Value>
431
      </TextContentType>
432
      <TextContentType>
433
        <Value>application/x-javascript</Value>
434
      </TextContentType>
435
      <TextContentType>
436
        <Value>application/json</Value>
437
      </TextContentType>
438
      <TextContentType>
439
        <Value>application/x-httpd-php-source</Value>
440
      </TextContentType>
441
    </TextContentTypeList>
442
    <XMLContentTypeList>
443
      <XMLContentType>
444
        <Value>application/xml-dtd</Value>
445
      </XMLContentType>
446
      <XMLContentType>
447
        <Value>text/xml</Value>
448
      </XMLContentType>
449
      <XMLContentType>
450
        <Value>application/soap+xml</Value>
451
      </XMLContentType>
452
      <XMLContentType>
453
        <Value>application/xml</Value>
454
      </XMLContentType>
455
    </XMLContentTypeList>
456
    <BrowserDownloadWhitelistList>
457
      <BrowserDownloadWhitelist>
458
        <Value>*.css</Value>
459
      </BrowserDownloadWhitelist>
460
      <BrowserDownloadWhitelist>
461
        <Value>*.js</Value>
462
      </BrowserDownloadWhitelist>
463
      <BrowserDownloadWhitelist>
464
        <Value>*.xml</Value>
465
      </BrowserDownloadWhitelist>
466
      <BrowserDownloadWhitelist>
467
        <Value>*.dtd</Value>
468
      </BrowserDownloadWhitelist>
469
      <BrowserDownloadWhitelist>
470
        <Value>*.axd</Value>
471
      </BrowserDownloadWhitelist>
472
      <BrowserDownloadWhitelist>
473
        <Value>*.json</Value>
474
      </BrowserDownloadWhitelist>
475
      <BrowserDownloadWhitelist>
476
        <Value>*/js/*</Value>
477
      </BrowserDownloadWhitelist>
478
      <BrowserDownloadWhitelist>
479
        <Value>*/css/*</Value>
480
      </BrowserDownloadWhitelist>
481
    </BrowserDownloadWhitelistList>
482
    <BrowserDoNotDownloadExtensionList>
483
      <BrowserDoNotDownloadExtension>
484
        <Value>pdf</Value>
485
      </BrowserDoNotDownloadExtension>
486
      <BrowserDoNotDownloadExtension>
487
        <Value>doc</Value>
488
      </BrowserDoNotDownloadExtension>
489
      <BrowserDoNotDownloadExtension>
490
        <Value>jpg</Value>
491
      </BrowserDoNotDownloadExtension>
492
      <BrowserDoNotDownloadExtension>
493
        <Value>jpeg</Value>
494
      </BrowserDoNotDownloadExtension>
495
      <BrowserDoNotDownloadExtension>
496
        <Value>gif</Value>
497
      </BrowserDoNotDownloadExtension>
498
      <BrowserDoNotDownloadExtension>
499
        <Value>png</Value>
500
      </BrowserDoNotDownloadExtension>
501
      <BrowserDoNotDownloadExtension>
502
        <Value>bmp</Value>
503
      </BrowserDoNotDownloadExtension>
504
      <BrowserDoNotDownloadExtension>
505
        <Value>ico</Value>
506
      </BrowserDoNotDownloadExtension>
507
      <BrowserDoNotDownloadExtension>
508
        <Value>exe</Value>
509
      </BrowserDoNotDownloadExtension>
510
      <BrowserDoNotDownloadExtension>
511
        <Value>swf</Value>
512
      </BrowserDoNotDownloadExtension>
513
      <BrowserDoNotDownloadExtension>
514
        <Value>mp3</Value>
515
      </BrowserDoNotDownloadExtension>
516
      <BrowserDoNotDownloadExtension>
517
        <Value>mp4</Value>
518
      </BrowserDoNotDownloadExtension>
519
      <BrowserDoNotDownloadExtension>
520
        <Value>wav</Value>
521
      </BrowserDoNotDownloadExtension>
522
      <BrowserDoNotDownloadExtension>
523
        <Value>eot</Value>
524
      </BrowserDoNotDownloadExtension>
525
      <BrowserDoNotDownloadExtension>
526
        <Value>ttf</Value>
527
      </BrowserDoNotDownloadExtension>
528
      <BrowserDoNotDownloadExtension>
529
        <Value>woff</Value>
530
      </BrowserDoNotDownloadExtension>
531
      <BrowserDoNotDownloadExtension>
532
        <Value>ico</Value>
533
      </BrowserDoNotDownloadExtension>
534
      <BrowserDoNotDownloadExtension>
535
        <Value>svg</Value>
536
      </BrowserDoNotDownloadExtension>
537
    </BrowserDoNotDownloadExtensionList>
538
    <BrowserDoNotDownloadContentTypeList>
539
      <BrowserDoNotDownloadContentType>
540
        <Value>audio/*</Value>
541
      </BrowserDoNotDownloadContentType>
542
      <BrowserDoNotDownloadContentType>
543
        <Value>image/*</Value>
544
      </BrowserDoNotDownloadContentType>
545
      <BrowserDoNotDownloadContentType>
546
        <Value>video/*</Value>
547
      </BrowserDoNotDownloadContentType>
548
      <BrowserDoNotDownloadContentType>
549
        <Value>application/pdf</Value>
550
      </BrowserDoNotDownloadContentType>
551
      <BrowserDoNotDownloadContentType>
552
        <Value>application/zip</Value>
553
      </BrowserDoNotDownloadContentType>
554
      <BrowserDoNotDownloadContentType>
555
        <Value>application/x-rar-compressed</Value>
556
      </BrowserDoNotDownloadContentType>
557
      <BrowserDoNotDownloadContentType>
558
        <Value>application/x-dvi</Value>
559
      </BrowserDoNotDownloadContentType>
560
      <BrowserDoNotDownloadContentType>
561
        <Value>application/x-shockwave-flash</Value>
562
      </BrowserDoNotDownloadContentType>
563
      <BrowserDoNotDownloadContentType>
564
        <Value>application/msword</Value>
565
      </BrowserDoNotDownloadContentType>
566
      <BrowserDoNotDownloadContentType>
567
        <Value>application/ogg</Value>
568
      </BrowserDoNotDownloadContentType>
569
      <BrowserDoNotDownloadContentType>
570
        <Value>application/x-tar</Value>
571
      </BrowserDoNotDownloadContentType>
572
      <BrowserDoNotDownloadContentType>
573
        <Value>application/octet-stream</Value>
574
      </BrowserDoNotDownloadContentType>
575
    </BrowserDoNotDownloadContentTypeList>
576
  </CrawlConfig>
577
  <AttackerConfig>
578
    <ParametersToAttackBeforeLimitingAttacks>400</ParametersToAttackBeforeLimitingAttacks>
579
    <LinksToAttackBeforeLimitingAttacks>200</LinksToAttackBeforeLimitingAttacks>
580
    <MaxSameNameParameterAttackPoints>25</MaxSameNameParameterAttackPoints>
581
    <MaxSameCookieParameterAttackPoints>15</MaxSameCookieParameterAttackPoints>
582
    <MaxSameNameParameterAttackPointsPerLink>2</MaxSameNameParameterAttackPointsPerLink>
583
    <MaxParameterAttackPointsPerLink>50</MaxParameterAttackPointsPerLink>
584
    <MaxNormalizedSameNameParameterAttackPointsPerLink>4</MaxNormalizedSameNameParameterAttackPointsPerLink>
585
    <ApplyGlobalFindingsSettings>1</ApplyGlobalFindingsSettings>
586
    <ApplyCrawlerConstraints>1</ApplyCrawlerConstraints>
587
    <MaxNumberOfScheduledPassiveAttacks>1000000</MaxNumberOfScheduledPassiveAttacks>
588
    <MinCookieLifetimeForAttacks>3600</MinCookieLifetimeForAttacks>
589
    <ExcludeLowConfidenceFindings>0</ExcludeLowConfidenceFindings>
590
    <OutOfBandHost></OutOfBandHost>
591
    <DefaultDoNotAttackParamList>
592
      <DefaultDoNotAttackParam>
593
        <ParameterName>^_*(ASP[.]NET_SessionId|VSTATE|VIEWSTATE(ENCRYPTED|FIELDCOUNT|GENERATOR|[0-9]*)|EVENT(VALIDATION|TTARGET|ARGUMENT)|COMPRESSEDVIEWSTATE|LASTFOCUS|CALLBACK(ID|FRAME|LOADSCRIPT|PARAM|INDEX)|SCROLLPOSITIONX|SCROLLPOSITIONY|utm.*|submit[.][x|y]|_ga|_gat|__utm[a|b|c|t|z|v|x])$</ParameterName>
594
        <MatchCriteria>Regex</MatchCriteria>
595
      </DefaultDoNotAttackParam>
596
    </DefaultDoNotAttackParamList>
597
  </AttackerConfig>
598
  <AttackPolicyConfig>
599
    <Policy>Default attack policy</Policy>
600
    <AttackPrioritization>Smart</AttackPrioritization>
601
    <AttackDepth>Smart</AttackDepth>
602
    <EnableAdvancedAttacks>0</EnableAdvancedAttacks>
603
    <FalsePositiveRegex>This web browser does not support JavaScript or JavaScript in this web browser is not enabled.</FalsePositiveRegex>
604
    <FalsePositiveFindingRegex></FalsePositiveFindingRegex>
605
    <RootCauseIdExcludeList></RootCauseIdExcludeList>
606
    <AttackOnlyControllingHeaders>1</AttackOnlyControllingHeaders>
607
    <EnforceEncoding>0</EnforceEncoding>
608
    <AttackPoints>Web Site|Directory|File|Web Resource|Parameter|Response Analysis</AttackPoints>
609
    <ParameterLocations>Directory|File|Path|Query|Fragment|Post|Cookie|Referer|Http Header</ParameterLocations>
610
    <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
611
    <AttackModulePolicyList>
612
      <AttackModulePolicy>
613
        <Enabled>1</Enabled>
614
        <ModuleId>C0B05B9C334341B180D2494235FF8F99</ModuleId>
615
        <ModulePriority>High</ModulePriority>
616
        <Severity>Informational</Severity>
617
        <MaxVulnLimit>10</MaxVulnLimit>
618
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
619
        <MaxVarianceLimit>2</MaxVarianceLimit>
620
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
621
        <EnforceEncoding>0</EnforceEncoding>
622
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
623
        <AttackPoints>Web Site</AttackPoints>
624
        <ParameterLocations></ParameterLocations>
625
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
626
        <DisplayName>Anonymous Access</DisplayName>
627
      </AttackModulePolicy>
628
      <AttackModulePolicy>
629
        <Enabled>1</Enabled>
630
        <ModuleId>59597A25A9504D5AAD20B74A4DCCABB7</ModuleId>
631
        <ModulePriority>High</ModulePriority>
632
        <Severity>High</Severity>
633
        <MaxVulnLimit>100</MaxVulnLimit>
634
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
635
        <MaxVarianceLimit>3</MaxVarianceLimit>
636
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
637
        <EnforceEncoding>0</EnforceEncoding>
638
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
639
        <AttackPoints>Directory|File|Web Resource|Parameter</AttackPoints>
640
        <ParameterLocations>Directory|File|Path|Query|Fragment|Post|Cookie|Referer|Http Header</ParameterLocations>
641
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
642
        <DisplayName>Apache Struts 2 Framework Checks</DisplayName>
643
      </AttackModulePolicy>
644
      <AttackModulePolicy>
645
        <Enabled>1</Enabled>
646
        <ModuleId>9F6600FB2E7840E48B156790FEFAC10A</ModuleId>
647
        <ModulePriority>High</ModulePriority>
648
        <Severity>Informational</Severity>
649
        <MaxVulnLimit>100</MaxVulnLimit>
650
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
651
        <MaxVarianceLimit>3</MaxVarianceLimit>
652
        <PassiveAnalysisOnAttacks>1</PassiveAnalysisOnAttacks>
653
        <EnforceEncoding>0</EnforceEncoding>
654
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
655
        <AttackPoints>Response Analysis</AttackPoints>
656
        <ParameterLocations></ParameterLocations>
657
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
658
        <DisplayName>Apache Struts Detection</DisplayName>
659
      </AttackModulePolicy>
660
      <AttackModulePolicy>
661
        <Enabled>1</Enabled>
662
        <ModuleId>929E08F60E084936B12C984ED0F5F47C</ModuleId>
663
        <ModulePriority>High</ModulePriority>
664
        <Severity>High</Severity>
665
        <MaxVulnLimit>100</MaxVulnLimit>
666
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
667
        <MaxVarianceLimit>4</MaxVarianceLimit>
668
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
669
        <EnforceEncoding>0</EnforceEncoding>
670
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
671
        <AttackPoints>Parameter</AttackPoints>
672
        <ParameterLocations>Post</ParameterLocations>
673
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
674
        <DisplayName>Arbitrary File Upload</DisplayName>
675
      </AttackModulePolicy>
676
      <AttackModulePolicy>
677
        <Enabled>1</Enabled>
678
        <ModuleId>719FF94DEF014D29B16234909941E48E</ModuleId>
679
        <ModulePriority>Medium</ModulePriority>
680
        <Severity>Low</Severity>
681
        <MaxVulnLimit>25</MaxVulnLimit>
682
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
683
        <MaxVarianceLimit>2</MaxVarianceLimit>
684
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
685
        <EnforceEncoding>0</EnforceEncoding>
686
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
687
        <AttackPoints>Directory</AttackPoints>
688
        <ParameterLocations></ParameterLocations>
689
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
690
        <DisplayName>ASP.NET Misconfiguration</DisplayName>
691
      </AttackModulePolicy>
692
      <AttackModulePolicy>
693
        <Enabled>1</Enabled>
694
        <ModuleId>B7CEE386C7C64618A510F3F8FED5400B</ModuleId>
695
        <ModulePriority>Medium</ModulePriority>
696
        <Severity>High</Severity>
697
        <MaxVulnLimit>25</MaxVulnLimit>
698
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
699
        <MaxVarianceLimit>4</MaxVarianceLimit>
700
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
701
        <EnforceEncoding>0</EnforceEncoding>
702
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
703
        <AttackPoints>Parameter</AttackPoints>
704
        <ParameterLocations>Post|Cookie</ParameterLocations>
705
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
706
        <DisplayName>ASP.NET Serialization</DisplayName>
707
      </AttackModulePolicy>
708
      <AttackModulePolicy>
709
        <Enabled>1</Enabled>
710
        <ModuleId>865E5CE0E5144D3E899B825EC8603969</ModuleId>
711
        <ModulePriority>Medium</ModulePriority>
712
        <Severity>Low</Severity>
713
        <MaxVulnLimit>200</MaxVulnLimit>
714
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
715
        <MaxVarianceLimit>2</MaxVarianceLimit>
716
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
717
        <EnforceEncoding>0</EnforceEncoding>
718
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
719
        <AttackPoints>Response Analysis</AttackPoints>
720
        <ParameterLocations></ParameterLocations>
721
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
722
        <DisplayName>Autocomplete attribute</DisplayName>
723
      </AttackModulePolicy>
724
      <AttackModulePolicy>
725
        <Enabled>1</Enabled>
726
        <ModuleId>38354857D10048B68A34CD2E3EBC3B52</ModuleId>
727
        <ModulePriority>High</ModulePriority>
728
        <Severity>High</Severity>
729
        <MaxVulnLimit>75</MaxVulnLimit>
730
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
731
        <MaxVarianceLimit>4</MaxVarianceLimit>
732
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
733
        <EnforceEncoding>0</EnforceEncoding>
734
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
735
        <AttackPoints>Parameter</AttackPoints>
736
        <ParameterLocations>Query|Post</ParameterLocations>
737
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
738
        <DisplayName>Blind LDAP Injection</DisplayName>
739
      </AttackModulePolicy>
740
      <AttackModulePolicy>
741
        <Enabled>1</Enabled>
742
        <ModuleId>13B4C758BA174200885A29CBA7346165</ModuleId>
743
        <ModulePriority>Medium</ModulePriority>
744
        <Severity>Informational</Severity>
745
        <MaxVulnLimit>100</MaxVulnLimit>
746
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
747
        <MaxVarianceLimit>1</MaxVarianceLimit>
748
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
749
        <EnforceEncoding>0</EnforceEncoding>
750
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
751
        <AttackPoints>Response Analysis</AttackPoints>
752
        <ParameterLocations></ParameterLocations>
753
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
754
        <DisplayName>Browser Cache directive (web application performance)</DisplayName>
755
      </AttackModulePolicy>
756
      <AttackModulePolicy>
757
        <Enabled>1</Enabled>
758
        <ModuleId>E33B272027B844D5BBB8EDE541983474</ModuleId>
759
        <ModulePriority>Medium</ModulePriority>
760
        <Severity>Low</Severity>
761
        <MaxVulnLimit>150</MaxVulnLimit>
762
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
763
        <MaxVarianceLimit>4</MaxVarianceLimit>
764
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
765
        <EnforceEncoding>0</EnforceEncoding>
766
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
767
        <AttackPoints>Response Analysis</AttackPoints>
768
        <ParameterLocations></ParameterLocations>
769
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
770
        <DisplayName>Browser Cache directive (leaking sensitive information)</DisplayName>
771
      </AttackModulePolicy>
772
      <AttackModulePolicy>
773
        <Enabled>1</Enabled>
774
        <ModuleId>A8091DB7769C49ED9E844B9F19529AC1</ModuleId>
775
        <ModulePriority>High</ModulePriority>
776
        <Severity>High</Severity>
777
        <MaxVulnLimit>5</MaxVulnLimit>
778
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
779
        <MaxVarianceLimit>2</MaxVarianceLimit>
780
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
781
        <EnforceEncoding>0</EnforceEncoding>
782
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
783
        <AttackPoints>Web Resource</AttackPoints>
784
        <ParameterLocations></ParameterLocations>
785
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
786
        <DisplayName>Brute Force (HTTP Auth)</DisplayName>
787
      </AttackModulePolicy>
788
      <AttackModulePolicy>
789
        <Enabled>1</Enabled>
790
        <ModuleId>7F61DDD522C5439B9EAB4FC17B2F47AA</ModuleId>
791
        <ModulePriority>High</ModulePriority>
792
        <Severity>High</Severity>
793
        <MaxVulnLimit>5</MaxVulnLimit>
794
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
795
        <MaxVarianceLimit>2</MaxVarianceLimit>
796
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
797
        <EnforceEncoding>0</EnforceEncoding>
798
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
799
        <AttackPoints>Parameter</AttackPoints>
800
        <ParameterLocations>Query|Post</ParameterLocations>
801
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
802
        <DisplayName>Brute Force (Form Auth)</DisplayName>
803
      </AttackModulePolicy>
804
      <AttackModulePolicy>
805
        <Enabled>1</Enabled>
806
        <ModuleId>22E85EEA6883403982D8C298AEBC935A</ModuleId>
807
        <ModulePriority>High</ModulePriority>
808
        <Severity>High</Severity>
809
        <MaxVulnLimit>250</MaxVulnLimit>
810
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
811
        <MaxVarianceLimit>4</MaxVarianceLimit>
812
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
813
        <EnforceEncoding>0</EnforceEncoding>
814
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
815
        <AttackPoints>Parameter</AttackPoints>
816
        <ParameterLocations>Directory|File|Path|Query|Post|Cookie|Referer|Http Header</ParameterLocations>
817
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
818
        <DisplayName>Blind SQL</DisplayName>
819
      </AttackModulePolicy>
820
      <AttackModulePolicy>
821
        <Enabled>1</Enabled>
822
        <ModuleId>FD1C760270CE493D92F50C347C79218F</ModuleId>
823
        <ModulePriority>Low</ModulePriority>
824
        <Severity>Low</Severity>
825
        <MaxVulnLimit>100</MaxVulnLimit>
826
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
827
        <MaxVarianceLimit>4</MaxVarianceLimit>
828
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
829
        <EnforceEncoding>0</EnforceEncoding>
830
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
831
        <AttackPoints>Directory</AttackPoints>
832
        <ParameterLocations></ParameterLocations>
833
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
834
        <DisplayName>Clients Cross-Domain Policy Files</DisplayName>
835
      </AttackModulePolicy>
836
      <AttackModulePolicy>
837
        <Enabled>1</Enabled>
838
        <ModuleId>A41D5AC842594BF086E9A96DD3353333</ModuleId>
839
        <ModulePriority>Low</ModulePriority>
840
        <Severity>Informational</Severity>
841
        <MaxVulnLimit>100</MaxVulnLimit>
842
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
843
        <MaxVarianceLimit>4</MaxVarianceLimit>
844
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
845
        <EnforceEncoding>0</EnforceEncoding>
846
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
847
        <AttackPoints>Response Analysis</AttackPoints>
848
        <ParameterLocations></ParameterLocations>
849
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
850
        <DisplayName>Information Disclosure in comments</DisplayName>
851
      </AttackModulePolicy>
852
      <AttackModulePolicy>
853
        <Enabled>1</Enabled>
854
        <ModuleId>BBFCB66779ED4E7292C08F19E9BB45DF</ModuleId>
855
        <ModulePriority>Medium</ModulePriority>
856
        <Severity>Low</Severity>
857
        <MaxVulnLimit>50</MaxVulnLimit>
858
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
859
        <MaxVarianceLimit>10</MaxVarianceLimit>
860
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
861
        <EnforceEncoding>0</EnforceEncoding>
862
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
863
        <AttackPoints>Response Analysis</AttackPoints>
864
        <ParameterLocations></ParameterLocations>
865
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
866
        <DisplayName>Cookie attributes</DisplayName>
867
      </AttackModulePolicy>
868
      <AttackModulePolicy>
869
        <Enabled>1</Enabled>
870
        <ModuleId>2227AE47A2AA40A6B6B1328AC13A6F0C</ModuleId>
871
        <ModulePriority>Low</ModulePriority>
872
        <Severity>Low</Severity>
873
        <MaxVulnLimit>100</MaxVulnLimit>
874
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
875
        <MaxVarianceLimit>5</MaxVarianceLimit>
876
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
877
        <EnforceEncoding>0</EnforceEncoding>
878
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
879
        <AttackPoints>Web Resource|Response Analysis</AttackPoints>
880
        <ParameterLocations></ParameterLocations>
881
        <RequestOriginations>AJAX</RequestOriginations>
882
        <DisplayName>Cross Origin Resources Sharing (CORS)</DisplayName>
883
      </AttackModulePolicy>
884
      <AttackModulePolicy>
885
        <Enabled>1</Enabled>
886
        <ModuleId>F8A0814584594965B0AF68B4E190F566</ModuleId>
887
        <ModulePriority>Low</ModulePriority>
888
        <Severity>Medium</Severity>
889
        <MaxVulnLimit>25</MaxVulnLimit>
890
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
891
        <MaxVarianceLimit>2</MaxVarianceLimit>
892
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
893
        <EnforceEncoding>0</EnforceEncoding>
894
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
895
        <AttackPoints>Response Analysis</AttackPoints>
896
        <ParameterLocations></ParameterLocations>
897
        <RequestOriginations>HTML|Form|Silverlight</RequestOriginations>
898
        <DisplayName>Credentials over an insecure channel</DisplayName>
899
      </AttackModulePolicy>
900
      <AttackModulePolicy>
901
        <Enabled>1</Enabled>
902
        <ModuleId>C35E7D79DD6F4DA489BBF6BC1D9D012B</ModuleId>
903
        <ModulePriority>Medium</ModulePriority>
904
        <Severity>Informational</Severity>
905
        <MaxVulnLimit>100</MaxVulnLimit>
906
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
907
        <MaxVarianceLimit>4</MaxVarianceLimit>
908
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
909
        <EnforceEncoding>0</EnforceEncoding>
910
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
911
        <AttackPoints>Response Analysis</AttackPoints>
912
        <ParameterLocations></ParameterLocations>
913
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
914
        <DisplayName>Content Security Policy Header</DisplayName>
915
      </AttackModulePolicy>
916
      <AttackModulePolicy>
917
        <Enabled>1</Enabled>
918
        <ModuleId>81C9D7ED0E33447899D5CD20B978617B</ModuleId>
919
        <ModulePriority>Low</ModulePriority>
920
        <Severity>Low</Severity>
921
        <MaxVulnLimit>250</MaxVulnLimit>
922
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
923
        <MaxVarianceLimit>2</MaxVarianceLimit>
924
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
925
        <EnforceEncoding>0</EnforceEncoding>
926
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
927
        <AttackPoints>Web Resource</AttackPoints>
928
        <ParameterLocations></ParameterLocations>
929
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
930
        <DisplayName>Cross-Site Request Forgery (CSRF)</DisplayName>
931
      </AttackModulePolicy>
932
      <AttackModulePolicy>
933
        <Enabled>0</Enabled>
934
        <ModuleId>3A586D24C653446196BAAC345FDE8C53</ModuleId>
935
        <ModulePriority>Medium</ModulePriority>
936
        <Severity>Informational</Severity>
937
        <MaxVulnLimit>20</MaxVulnLimit>
938
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
939
        <MaxVarianceLimit>1</MaxVarianceLimit>
940
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
941
        <EnforceEncoding>0</EnforceEncoding>
942
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
943
        <AttackPoints>Directory</AttackPoints>
944
        <ParameterLocations></ParameterLocations>
945
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
946
        <DisplayName>Custom Directory Module</DisplayName>
947
      </AttackModulePolicy>
948
      <AttackModulePolicy>
949
        <Enabled>0</Enabled>
950
        <ModuleId>EE998B281CE840948E90BF2D61E4C5F9</ModuleId>
951
        <ModulePriority>Medium</ModulePriority>
952
        <Severity>Informational</Severity>
953
        <MaxVulnLimit>20</MaxVulnLimit>
954
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
955
        <MaxVarianceLimit>1</MaxVarianceLimit>
956
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
957
        <EnforceEncoding>0</EnforceEncoding>
958
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
959
        <AttackPoints>Parameter</AttackPoints>
960
        <ParameterLocations>Directory|File|Path|Query|Fragment|Post|Cookie|Referer|Http Header</ParameterLocations>
961
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
962
        <DisplayName>Custom Parameter Module</DisplayName>
963
      </AttackModulePolicy>
964
      <AttackModulePolicy>
965
        <Enabled>0</Enabled>
966
        <ModuleId>1DE8C004C53D4B89A41E6B98DC6FD3B4</ModuleId>
967
        <ModulePriority>Medium</ModulePriority>
968
        <Severity>Informational</Severity>
969
        <MaxVulnLimit>20</MaxVulnLimit>
970
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
971
        <MaxVarianceLimit>1</MaxVarianceLimit>
972
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
973
        <EnforceEncoding>0</EnforceEncoding>
974
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
975
        <AttackPoints>Response Analysis</AttackPoints>
976
        <ParameterLocations></ParameterLocations>
977
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
978
        <DisplayName>Custom Passive Module</DisplayName>
979
      </AttackModulePolicy>
980
      <AttackModulePolicy>
981
        <Enabled>1</Enabled>
982
        <ModuleId>2CE90A403F704F80961E381BE19CCA2F</ModuleId>
983
        <ModulePriority>Medium</ModulePriority>
984
        <Severity>Low</Severity>
985
        <MaxVulnLimit>250</MaxVulnLimit>
986
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
987
        <MaxVarianceLimit>1</MaxVarianceLimit>
988
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
989
        <EnforceEncoding>0</EnforceEncoding>
990
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
991
        <AttackPoints>Directory</AttackPoints>
992
        <ParameterLocations></ParameterLocations>
993
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
994
        <DisplayName>Directory Indexing</DisplayName>
995
      </AttackModulePolicy>
996
      <AttackModulePolicy>
997
        <Enabled>1</Enabled>
998
        <ModuleId>240EBB4A72024BA585833EB1F1AB4EC0</ModuleId>
999
        <ModulePriority>Low</ModulePriority>
1000
        <Severity>Informational</Severity>
1001
        <MaxVulnLimit>150</MaxVulnLimit>
1002
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1003
        <MaxVarianceLimit>4</MaxVarianceLimit>
1004
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1005
        <EnforceEncoding>0</EnforceEncoding>
1006
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1007
        <AttackPoints>Response Analysis</AttackPoints>
1008
        <ParameterLocations></ParameterLocations>
1009
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
1010
        <DisplayName>Email Disclosure</DisplayName>
1011
      </AttackModulePolicy>
1012
      <AttackModulePolicy>
1013
        <Enabled>1</Enabled>
1014
        <ModuleId>9B62D146FF00456388F9822A76F95841</ModuleId>
1015
        <ModulePriority>High</ModulePriority>
1016
        <Severity>High</Severity>
1017
        <MaxVulnLimit>100</MaxVulnLimit>
1018
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1019
        <MaxVarianceLimit>4</MaxVarianceLimit>
1020
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1021
        <EnforceEncoding>0</EnforceEncoding>
1022
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1023
        <AttackPoints>Parameter</AttackPoints>
1024
        <ParameterLocations>Path|Query|Post</ParameterLocations>
1025
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1026
        <DisplayName>Expression Language Injection</DisplayName>
1027
      </AttackModulePolicy>
1028
      <AttackModulePolicy>
1029
        <Enabled>1</Enabled>
1030
        <ModuleId>D07D5C8EF8664392A0CC1509A6DE5940</ModuleId>
1031
        <ModulePriority>Low</ModulePriority>
1032
        <Severity>Low</Severity>
1033
        <MaxVulnLimit>100</MaxVulnLimit>
1034
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1035
        <MaxVarianceLimit>2</MaxVarianceLimit>
1036
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1037
        <EnforceEncoding>0</EnforceEncoding>
1038
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1039
        <AttackPoints>Parameter</AttackPoints>
1040
        <ParameterLocations>Directory|Path|Query|Post|Cookie</ParameterLocations>
1041
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1042
        <DisplayName>Forced Browsing</DisplayName>
1043
      </AttackModulePolicy>
1044
      <AttackModulePolicy>
1045
        <Enabled>1</Enabled>
1046
        <ModuleId>FD28B5D41E064D37B5543CE22BBC6306</ModuleId>
1047
        <ModulePriority>Medium</ModulePriority>
1048
        <Severity>Low</Severity>
1049
        <MaxVulnLimit>200</MaxVulnLimit>
1050
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1051
        <MaxVarianceLimit>2</MaxVarianceLimit>
1052
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1053
        <EnforceEncoding>0</EnforceEncoding>
1054
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1055
        <AttackPoints>Response Analysis</AttackPoints>
1056
        <ParameterLocations></ParameterLocations>
1057
        <RequestOriginations>HTML|Form|Silverlight</RequestOriginations>
1058
        <DisplayName>Sensitive Data Exposure</DisplayName>
1059
      </AttackModulePolicy>
1060
      <AttackModulePolicy>
1061
        <Enabled>1</Enabled>
1062
        <ModuleId>7B61BD81D278490C9B1A7B0568E94E30</ModuleId>
1063
        <ModulePriority>High</ModulePriority>
1064
        <Severity>Low</Severity>
1065
        <MaxVulnLimit>5</MaxVulnLimit>
1066
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1067
        <MaxVarianceLimit>4</MaxVarianceLimit>
1068
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1069
        <EnforceEncoding>0</EnforceEncoding>
1070
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1071
        <AttackPoints>Web Resource</AttackPoints>
1072
        <ParameterLocations></ParameterLocations>
1073
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
1074
        <DisplayName>Form Session Strength</DisplayName>
1075
      </AttackModulePolicy>
1076
      <AttackModulePolicy>
1077
        <Enabled>1</Enabled>
1078
        <ModuleId>5032DAF0D8FE4294B23F0D1DAA4C0337</ModuleId>
1079
        <ModulePriority>High</ModulePriority>
1080
        <Severity>High</Severity>
1081
        <MaxVulnLimit>25</MaxVulnLimit>
1082
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1083
        <MaxVarianceLimit>50</MaxVarianceLimit>
1084
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1085
        <EnforceEncoding>0</EnforceEncoding>
1086
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1087
        <AttackPoints>Web Site</AttackPoints>
1088
        <ParameterLocations></ParameterLocations>
1089
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
1090
        <DisplayName>FrontPage Checks</DisplayName>
1091
      </AttackModulePolicy>
1092
      <AttackModulePolicy>
1093
        <Enabled>1</Enabled>
1094
        <ModuleId>748E90FC47AB4B438C3A49660989B44A</ModuleId>
1095
        <ModulePriority>High</ModulePriority>
1096
        <Severity>High</Severity>
1097
        <MaxVulnLimit>25</MaxVulnLimit>
1098
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1099
        <MaxVarianceLimit>1</MaxVarianceLimit>
1100
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1101
        <EnforceEncoding>0</EnforceEncoding>
1102
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1103
        <AttackPoints>Web Site</AttackPoints>
1104
        <ParameterLocations></ParameterLocations>
1105
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1106
        <DisplayName>Heartbleed Check</DisplayName>
1107
      </AttackModulePolicy>
1108
      <AttackModulePolicy>
1109
        <Enabled>1</Enabled>
1110
        <ModuleId>EBEE6CA2515F4FBEB8B7EC0197C5A74F</ModuleId>
1111
        <ModulePriority>Low</ModulePriority>
1112
        <Severity>Informational</Severity>
1113
        <MaxVulnLimit>20</MaxVulnLimit>
1114
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1115
        <MaxVarianceLimit>1</MaxVarianceLimit>
1116
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1117
        <EnforceEncoding>0</EnforceEncoding>
1118
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1119
        <AttackPoints>Response Analysis</AttackPoints>
1120
        <ParameterLocations></ParameterLocations>
1121
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1122
        <DisplayName>HTTP Strict Transport Security</DisplayName>
1123
      </AttackModulePolicy>
1124
      <AttackModulePolicy>
1125
        <Enabled>1</Enabled>
1126
        <ModuleId>F25AF6387E8A429F8E664F31E2974054</ModuleId>
1127
        <ModulePriority>Low</ModulePriority>
1128
        <Severity>Low</Severity>
1129
        <MaxVulnLimit>20</MaxVulnLimit>
1130
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1131
        <MaxVarianceLimit>4</MaxVarianceLimit>
1132
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1133
        <EnforceEncoding>0</EnforceEncoding>
1134
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1135
        <AttackPoints>Response Analysis</AttackPoints>
1136
        <ParameterLocations></ParameterLocations>
1137
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1138
        <DisplayName>HTTP Authentication over insecure channel</DisplayName>
1139
      </AttackModulePolicy>
1140
      <AttackModulePolicy>
1141
        <Enabled>1</Enabled>
1142
        <ModuleId>60B0D57597EF4542A15FCB8D907669B0</ModuleId>
1143
        <ModulePriority>Low</ModulePriority>
1144
        <Severity>Low</Severity>
1145
        <MaxVulnLimit>200</MaxVulnLimit>
1146
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1147
        <MaxVarianceLimit>1</MaxVarianceLimit>
1148
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1149
        <EnforceEncoding>0</EnforceEncoding>
1150
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1151
        <AttackPoints>Web Resource</AttackPoints>
1152
        <ParameterLocations></ParameterLocations>
1153
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1154
        <DisplayName>HTTPS Downgrade</DisplayName>
1155
      </AttackModulePolicy>
1156
      <AttackModulePolicy>
1157
        <Enabled>1</Enabled>
1158
        <ModuleId>55D76EB20CE54C01856E43223232E3DD</ModuleId>
1159
        <ModulePriority>Medium</ModulePriority>
1160
        <Severity>Informational</Severity>
1161
        <MaxVulnLimit>200</MaxVulnLimit>
1162
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1163
        <MaxVarianceLimit>4</MaxVarianceLimit>
1164
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1165
        <EnforceEncoding>0</EnforceEncoding>
1166
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1167
        <AttackPoints>Response Analysis</AttackPoints>
1168
        <ParameterLocations></ParameterLocations>
1169
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1170
        <DisplayName>HTTP Headers</DisplayName>
1171
      </AttackModulePolicy>
1172
      <AttackModulePolicy>
1173
        <Enabled>1</Enabled>
1174
        <ModuleId>DE08B6DDD872440E91347969D514CFD6</ModuleId>
1175
        <ModulePriority>High</ModulePriority>
1176
        <Severity>High</Severity>
1177
        <MaxVulnLimit>200</MaxVulnLimit>
1178
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1179
        <MaxVarianceLimit>4</MaxVarianceLimit>
1180
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1181
        <EnforceEncoding>0</EnforceEncoding>
1182
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1183
        <AttackPoints>Parameter</AttackPoints>
1184
        <ParameterLocations>Directory|File|Path|Query|Fragment|Post|Cookie|Referer|Http Header</ParameterLocations>
1185
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1186
        <DisplayName>HTTP Response Splitting</DisplayName>
1187
      </AttackModulePolicy>
1188
      <AttackModulePolicy>
1189
        <Enabled>1</Enabled>
1190
        <ModuleId>1712CD453B074C78A8A561E0ED66DD1F</ModuleId>
1191
        <ModulePriority>Low</ModulePriority>
1192
        <Severity>Low</Severity>
1193
        <MaxVulnLimit>200</MaxVulnLimit>
1194
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1195
        <MaxVarianceLimit>1</MaxVarianceLimit>
1196
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1197
        <EnforceEncoding>0</EnforceEncoding>
1198
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1199
        <AttackPoints>Web Site|Web Resource|Response Analysis</AttackPoints>
1200
        <ParameterLocations></ParameterLocations>
1201
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1202
        <DisplayName>HTTPS Everywhere</DisplayName>
1203
      </AttackModulePolicy>
1204
      <AttackModulePolicy>
1205
        <Enabled>1</Enabled>
1206
        <ModuleId>881B35A841414BBAA05084A2A8CE7904</ModuleId>
1207
        <ModulePriority>Low</ModulePriority>
1208
        <Severity>Informational</Severity>
1209
        <MaxVulnLimit>20</MaxVulnLimit>
1210
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1211
        <MaxVarianceLimit>1</MaxVarianceLimit>
1212
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1213
        <EnforceEncoding>0</EnforceEncoding>
1214
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1215
        <AttackPoints>Web Resource</AttackPoints>
1216
        <ParameterLocations></ParameterLocations>
1217
        <RequestOriginations>HTML|Form|Flash|Silverlight</RequestOriginations>
1218
        <DisplayName>HTTP User-Agent Check</DisplayName>
1219
      </AttackModulePolicy>
1220
      <AttackModulePolicy>
1221
        <Enabled>1</Enabled>
1222
        <ModuleId>6A609D0096124619842EE23FA7C989B5</ModuleId>
1223
        <ModulePriority>Low</ModulePriority>
1224
        <Severity>Informational</Severity>
1225
        <MaxVulnLimit>500</MaxVulnLimit>
1226
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1227
        <MaxVarianceLimit>4</MaxVarianceLimit>
1228
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1229
        <EnforceEncoding>0</EnforceEncoding>
1230
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1231
        <AttackPoints>Response Analysis</AttackPoints>
1232
        <ParameterLocations></ParameterLocations>
1233
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1234
        <DisplayName>Information Disclosure in response</DisplayName>
1235
      </AttackModulePolicy>
1236
      <AttackModulePolicy>
1237
        <Enabled>1</Enabled>
1238
        <ModuleId>E617D008F7534C808064D2B1A4BFE81A</ModuleId>
1239
        <ModulePriority>High</ModulePriority>
1240
        <Severity>Low</Severity>
1241
        <MaxVulnLimit>500</MaxVulnLimit>
1242
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1243
        <MaxVarianceLimit>4</MaxVarianceLimit>
1244
        <PassiveAnalysisOnAttacks>1</PassiveAnalysisOnAttacks>
1245
        <EnforceEncoding>0</EnforceEncoding>
1246
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1247
        <AttackPoints>Response Analysis</AttackPoints>
1248
        <ParameterLocations></ParameterLocations>
1249
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1250
        <DisplayName>Information Leakage in responses</DisplayName>
1251
      </AttackModulePolicy>
1252
      <AttackModulePolicy>
1253
        <Enabled>1</Enabled>
1254
        <ModuleId>B86A3A67D710456898A9009DBF6A4989</ModuleId>
1255
        <ModulePriority>Low</ModulePriority>
1256
        <Severity>Low</Severity>
1257
        <MaxVulnLimit>100</MaxVulnLimit>
1258
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1259
        <MaxVarianceLimit>4</MaxVarianceLimit>
1260
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1261
        <EnforceEncoding>0</EnforceEncoding>
1262
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1263
        <AttackPoints>Web Resource</AttackPoints>
1264
        <ParameterLocations></ParameterLocations>
1265
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
1266
        <DisplayName>Java Grinder</DisplayName>
1267
      </AttackModulePolicy>
1268
      <AttackModulePolicy>
1269
        <Enabled>1</Enabled>
1270
        <ModuleId>F10ACEB0A6804D0F93516428E64B46FD</ModuleId>
1271
        <ModulePriority>Low</ModulePriority>
1272
        <Severity>Informational</Severity>
1273
        <MaxVulnLimit>100</MaxVulnLimit>
1274
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1275
        <MaxVarianceLimit>4</MaxVarianceLimit>
1276
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1277
        <EnforceEncoding>0</EnforceEncoding>
1278
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1279
        <AttackPoints>Response Analysis</AttackPoints>
1280
        <ParameterLocations></ParameterLocations>
1281
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight</RequestOriginations>
1282
        <DisplayName>JavaScript Memory Leaks</DisplayName>
1283
      </AttackModulePolicy>
1284
      <AttackModulePolicy>
1285
        <Enabled>1</Enabled>
1286
        <ModuleId>B7FD0D454CB246AC85A29AF53C27157F</ModuleId>
1287
        <ModulePriority>High</ModulePriority>
1288
        <Severity>High</Severity>
1289
        <MaxVulnLimit>100</MaxVulnLimit>
1290
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1291
        <MaxVarianceLimit>4</MaxVarianceLimit>
1292
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1293
        <EnforceEncoding>0</EnforceEncoding>
1294
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1295
        <AttackPoints>Parameter</AttackPoints>
1296
        <ParameterLocations>Path|Query|Post|Cookie</ParameterLocations>
1297
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1298
        <DisplayName>LDAP Injection</DisplayName>
1299
      </AttackModulePolicy>
1300
      <AttackModulePolicy>
1301
        <Enabled>1</Enabled>
1302
        <ModuleId>FCD9A41AD39247C0B45A8D42FF7A4E5E</ModuleId>
1303
        <ModulePriority>High</ModulePriority>
1304
        <Severity>Informational</Severity>
1305
        <MaxVulnLimit>250</MaxVulnLimit>
1306
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1307
        <MaxVarianceLimit>4</MaxVarianceLimit>
1308
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1309
        <EnforceEncoding>0</EnforceEncoding>
1310
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1311
        <AttackPoints>Response Analysis</AttackPoints>
1312
        <ParameterLocations></ParameterLocations>
1313
        <RequestOriginations>HTML|Form|AJAX</RequestOriginations>
1314
        <DisplayName>Local Storage Usage</DisplayName>
1315
      </AttackModulePolicy>
1316
      <AttackModulePolicy>
1317
        <Enabled>1</Enabled>
1318
        <ModuleId>466E4CC294D94A11AFD50FD01D56261F</ModuleId>
1319
        <ModulePriority>Medium</ModulePriority>
1320
        <Severity>Low</Severity>
1321
        <MaxVulnLimit>100</MaxVulnLimit>
1322
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1323
        <MaxVarianceLimit>4</MaxVarianceLimit>
1324
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1325
        <EnforceEncoding>0</EnforceEncoding>
1326
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1327
        <AttackPoints>Parameter|Response Analysis</AttackPoints>
1328
        <ParameterLocations>Path|Query|Post|Cookie|Referer</ParameterLocations>
1329
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1330
        <DisplayName>Business logic abuse attacks</DisplayName>
1331
      </AttackModulePolicy>
1332
      <AttackModulePolicy>
1333
        <Enabled>1</Enabled>
1334
        <ModuleId>7D06B46D915644E9870F4A6B903FC09F</ModuleId>
1335
        <ModulePriority>High</ModulePriority>
1336
        <Severity>High</Severity>
1337
        <MaxVulnLimit>10</MaxVulnLimit>
1338
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1339
        <MaxVarianceLimit>1</MaxVarianceLimit>
1340
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1341
        <EnforceEncoding>0</EnforceEncoding>
1342
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1343
        <AttackPoints>Parameter</AttackPoints>
1344
        <ParameterLocations>Path|Query|Post|Cookie|Referer</ParameterLocations>
1345
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1346
        <DisplayName>Nginx NULL code</DisplayName>
1347
      </AttackModulePolicy>
1348
      <AttackModulePolicy>
1349
        <Enabled>1</Enabled>
1350
        <ModuleId>99E5E4DD1B734047B95402FB7C76BEC3</ModuleId>
1351
        <ModulePriority>Medium</ModulePriority>
1352
        <Severity>High</Severity>
1353
        <MaxVulnLimit>200</MaxVulnLimit>
1354
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1355
        <MaxVarianceLimit>4</MaxVarianceLimit>
1356
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1357
        <EnforceEncoding>0</EnforceEncoding>
1358
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1359
        <AttackPoints>Parameter</AttackPoints>
1360
        <ParameterLocations>File|Path|Query|Post</ParameterLocations>
1361
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1362
        <DisplayName>OS Commanding</DisplayName>
1363
      </AttackModulePolicy>
1364
      <AttackModulePolicy>
1365
        <Enabled>1</Enabled>
1366
        <ModuleId>2934BC76771C4016BD3524B432CEBCA8</ModuleId>
1367
        <ModulePriority>High</ModulePriority>
1368
        <Severity>High</Severity>
1369
        <MaxVulnLimit>250</MaxVulnLimit>
1370
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1371
        <MaxVarianceLimit>5</MaxVarianceLimit>
1372
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1373
        <EnforceEncoding>0</EnforceEncoding>
1374
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1375
        <AttackPoints>Parameter</AttackPoints>
1376
        <ParameterLocations>Query|Post</ParameterLocations>
1377
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1378
        <DisplayName>Out of Band Stored Cross-site scripting (XSS)</DisplayName>
1379
      </AttackModulePolicy>
1380
      <AttackModulePolicy>
1381
        <Enabled>1</Enabled>
1382
        <ModuleId>A62D1481CB394632B06C0C54FCDD0579</ModuleId>
1383
        <ModulePriority>High</ModulePriority>
1384
        <Severity>Medium</Severity>
1385
        <MaxVulnLimit>250</MaxVulnLimit>
1386
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1387
        <MaxVarianceLimit>5</MaxVarianceLimit>
1388
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1389
        <EnforceEncoding>0</EnforceEncoding>
1390
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1391
        <AttackPoints>Parameter</AttackPoints>
1392
        <ParameterLocations>Query|Post</ParameterLocations>
1393
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1394
        <DisplayName>Out of Band Cross-site scripting (XSS)</DisplayName>
1395
      </AttackModulePolicy>
1396
      <AttackModulePolicy>
1397
        <Enabled>1</Enabled>
1398
        <ModuleId>A8AB603EABC04875A5B2320CF6990C24</ModuleId>
1399
        <ModulePriority>High</ModulePriority>
1400
        <Severity>Medium</Severity>
1401
        <MaxVulnLimit>500</MaxVulnLimit>
1402
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1403
        <MaxVarianceLimit>4</MaxVarianceLimit>
1404
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1405
        <EnforceEncoding>0</EnforceEncoding>
1406
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1407
        <AttackPoints>Parameter</AttackPoints>
1408
        <ParameterLocations>Path|Query|Post|Cookie|Referer</ParameterLocations>
1409
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1410
        <DisplayName>Parameter Fuzzing</DisplayName>
1411
      </AttackModulePolicy>
1412
      <AttackModulePolicy>
1413
        <Enabled>1</Enabled>
1414
        <ModuleId>FAC53175FF1E4478AA6D3E2DD4D66B6D</ModuleId>
1415
        <ModulePriority>High</ModulePriority>
1416
        <Severity>Low</Severity>
1417
        <MaxVulnLimit>10</MaxVulnLimit>
1418
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1419
        <MaxVarianceLimit>2</MaxVarianceLimit>
1420
        <PassiveAnalysisOnAttacks>1</PassiveAnalysisOnAttacks>
1421
        <EnforceEncoding>0</EnforceEncoding>
1422
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1423
        <AttackPoints>Response Analysis</AttackPoints>
1424
        <ParameterLocations></ParameterLocations>
1425
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1426
        <DisplayName>Credentials stored in clear text in a cookie.</DisplayName>
1427
      </AttackModulePolicy>
1428
      <AttackModulePolicy>
1429
        <Enabled>1</Enabled>
1430
        <ModuleId>243C315A46A14C92A2717A29A4290167</ModuleId>
1431
        <ModulePriority>Medium</ModulePriority>
1432
        <Severity>Informational</Severity>
1433
        <MaxVulnLimit>200</MaxVulnLimit>
1434
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1435
        <MaxVarianceLimit>10</MaxVarianceLimit>
1436
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1437
        <EnforceEncoding>0</EnforceEncoding>
1438
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1439
        <AttackPoints>Response Analysis</AttackPoints>
1440
        <ParameterLocations></ParameterLocations>
1441
        <RequestOriginations>HTML|Form|Silverlight</RequestOriginations>
1442
        <DisplayName>Collecting Sensitive Personal Information</DisplayName>
1443
      </AttackModulePolicy>
1444
      <AttackModulePolicy>
1445
        <Enabled>1</Enabled>
1446
        <ModuleId>B97A29683AEE4AA2B94FC26BFC2694A9</ModuleId>
1447
        <ModulePriority>High</ModulePriority>
1448
        <Severity>Medium</Severity>
1449
        <MaxVulnLimit>100</MaxVulnLimit>
1450
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1451
        <MaxVarianceLimit>4</MaxVarianceLimit>
1452
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1453
        <EnforceEncoding>0</EnforceEncoding>
1454
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1455
        <AttackPoints>Parameter</AttackPoints>
1456
        <ParameterLocations>Query|Post|Cookie</ParameterLocations>
1457
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1458
        <DisplayName>PHP Code Execution</DisplayName>
1459
      </AttackModulePolicy>
1460
      <AttackModulePolicy>
1461
        <Enabled>1</Enabled>
1462
        <ModuleId>FF01402DB70848D88ACB0736B6E4BCF5</ModuleId>
1463
        <ModulePriority>High</ModulePriority>
1464
        <Severity>Low</Severity>
1465
        <MaxVulnLimit>4</MaxVulnLimit>
1466
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1467
        <MaxVarianceLimit>4</MaxVarianceLimit>
1468
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1469
        <EnforceEncoding>0</EnforceEncoding>
1470
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1471
        <AttackPoints>Web Resource</AttackPoints>
1472
        <ParameterLocations></ParameterLocations>
1473
        <RequestOriginations>HTML</RequestOriginations>
1474
        <DisplayName>Privacy Policy Check</DisplayName>
1475
      </AttackModulePolicy>
1476
      <AttackModulePolicy>
1477
        <Enabled>1</Enabled>
1478
        <ModuleId>AFF041E38E444889B271CDE1B24378EA</ModuleId>
1479
        <ModulePriority>Low</ModulePriority>
1480
        <Severity>Informational</Severity>
1481
        <MaxVulnLimit>250</MaxVulnLimit>
1482
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1483
        <MaxVarianceLimit>10</MaxVarianceLimit>
1484
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1485
        <EnforceEncoding>0</EnforceEncoding>
1486
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1487
        <AttackPoints>Response Analysis</AttackPoints>
1488
        <ParameterLocations></ParameterLocations>
1489
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1490
        <DisplayName>Privacy Disclosure</DisplayName>
1491
      </AttackModulePolicy>
1492
      <AttackModulePolicy>
1493
        <Enabled>1</Enabled>
1494
        <ModuleId>433C43A54C714F08B822B7932D410A78</ModuleId>
1495
        <ModulePriority>Medium</ModulePriority>
1496
        <Severity>Low</Severity>
1497
        <MaxVulnLimit>10</MaxVulnLimit>
1498
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1499
        <MaxVarianceLimit>4</MaxVarianceLimit>
1500
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1501
        <EnforceEncoding>0</EnforceEncoding>
1502
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1503
        <AttackPoints>Web Resource|Response Analysis</AttackPoints>
1504
        <ParameterLocations></ParameterLocations>
1505
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1506
        <DisplayName>Privilege Escalation</DisplayName>
1507
      </AttackModulePolicy>
1508
      <AttackModulePolicy>
1509
        <Enabled>1</Enabled>
1510
        <ModuleId>ED2E98EFF9A14BF7ACA06A7B28FF97BE</ModuleId>
1511
        <ModulePriority>Low</ModulePriority>
1512
        <Severity>Informational</Severity>
1513
        <MaxVulnLimit>200</MaxVulnLimit>
1514
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1515
        <MaxVarianceLimit>4</MaxVarianceLimit>
1516
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1517
        <EnforceEncoding>0</EnforceEncoding>
1518
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1519
        <AttackPoints>Response Analysis</AttackPoints>
1520
        <ParameterLocations></ParameterLocations>
1521
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1522
        <DisplayName>Profanity</DisplayName>
1523
      </AttackModulePolicy>
1524
      <AttackModulePolicy>
1525
        <Enabled>1</Enabled>
1526
        <ModuleId>0AE25E41D6F44F29900104EF86B04191</ModuleId>
1527
        <ModulePriority>Low</ModulePriority>
1528
        <Severity>Safe</Severity>
1529
        <MaxVulnLimit>500</MaxVulnLimit>
1530
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1531
        <MaxVarianceLimit>4</MaxVarianceLimit>
1532
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1533
        <EnforceEncoding>0</EnforceEncoding>
1534
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1535
        <AttackPoints>Parameter</AttackPoints>
1536
        <ParameterLocations>Directory|File|Path|Query|Post|Cookie</ParameterLocations>
1537
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
1538
        <DisplayName>Reflection</DisplayName>
1539
      </AttackModulePolicy>
1540
      <AttackModulePolicy>
1541
        <Enabled>1</Enabled>
1542
        <ModuleId>8CB2F93CE7F243B98D3C83A9A3E6EA4B</ModuleId>
1543
        <ModulePriority>Medium</ModulePriority>
1544
        <Severity>Medium</Severity>
1545
        <MaxVulnLimit>1000</MaxVulnLimit>
1546
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1547
        <MaxVarianceLimit>4</MaxVarianceLimit>
1548
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1549
        <EnforceEncoding>0</EnforceEncoding>
1550
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1551
        <AttackPoints>Directory|File|Parameter</AttackPoints>
1552
        <ParameterLocations>Query|Post|Cookie</ParameterLocations>
1553
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1554
        <DisplayName>File Inclusion</DisplayName>
1555
      </AttackModulePolicy>
1556
      <AttackModulePolicy>
1557
        <Enabled>1</Enabled>
1558
        <ModuleId>63430695B68941DF99BF242F5AE1674B</ModuleId>
1559
        <ModulePriority>Low</ModulePriority>
1560
        <Severity>Informational</Severity>
1561
        <MaxVulnLimit>50</MaxVulnLimit>
1562
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1563
        <MaxVarianceLimit>2</MaxVarianceLimit>
1564
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1565
        <EnforceEncoding>0</EnforceEncoding>
1566
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1567
        <AttackPoints>Web Resource</AttackPoints>
1568
        <ParameterLocations></ParameterLocations>
1569
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1570
        <DisplayName>HTTP Verb Tampering</DisplayName>
1571
      </AttackModulePolicy>
1572
      <AttackModulePolicy>
1573
        <Enabled>1</Enabled>
1574
        <ModuleId>D8741C7560B8431A9AE74E9B4FEB4F45</ModuleId>
1575
        <ModulePriority>Low</ModulePriority>
1576
        <Severity>Low</Severity>
1577
        <MaxVulnLimit>200</MaxVulnLimit>
1578
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1579
        <MaxVarianceLimit>10</MaxVarianceLimit>
1580
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1581
        <EnforceEncoding>0</EnforceEncoding>
1582
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1583
        <AttackPoints>Web Site|Directory|File</AttackPoints>
1584
        <ParameterLocations></ParameterLocations>
1585
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1586
        <DisplayName>Predictable Resource Location</DisplayName>
1587
      </AttackModulePolicy>
1588
      <AttackModulePolicy>
1589
        <Enabled>1</Enabled>
1590
        <ModuleId>13623AA162FA4488852116B7EC0DE49E</ModuleId>
1591
        <ModulePriority>Medium</ModulePriority>
1592
        <Severity>Medium</Severity>
1593
        <MaxVulnLimit>250</MaxVulnLimit>
1594
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1595
        <MaxVarianceLimit>4</MaxVarianceLimit>
1596
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1597
        <EnforceEncoding>0</EnforceEncoding>
1598
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1599
        <AttackPoints>Parameter</AttackPoints>
1600
        <ParameterLocations>Query</ParameterLocations>
1601
        <RequestOriginations>HTML|Form</RequestOriginations>
1602
        <DisplayName>Reverse Clickjacking</DisplayName>
1603
      </AttackModulePolicy>
1604
      <AttackModulePolicy>
1605
        <Enabled>1</Enabled>
1606
        <ModuleId>A418163442A54BB9BB0F1E591881A835</ModuleId>
1607
        <ModulePriority>High</ModulePriority>
1608
        <Severity>Low</Severity>
1609
        <MaxVulnLimit>25</MaxVulnLimit>
1610
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1611
        <MaxVarianceLimit>1</MaxVarianceLimit>
1612
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1613
        <EnforceEncoding>0</EnforceEncoding>
1614
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1615
        <AttackPoints>Web Site</AttackPoints>
1616
        <ParameterLocations></ParameterLocations>
1617
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1618
        <DisplayName>Reverse Proxy</DisplayName>
1619
      </AttackModulePolicy>
1620
      <AttackModulePolicy>
1621
        <Enabled>1</Enabled>
1622
        <ModuleId>2C7D393BABA44517B0A37DC8ADCF9630</ModuleId>
1623
        <ModulePriority>Low</ModulePriority>
1624
        <Severity>Low</Severity>
1625
        <MaxVulnLimit>200</MaxVulnLimit>
1626
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1627
        <MaxVarianceLimit>4</MaxVarianceLimit>
1628
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1629
        <EnforceEncoding>0</EnforceEncoding>
1630
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1631
        <AttackPoints>Response Analysis</AttackPoints>
1632
        <ParameterLocations></ParameterLocations>
1633
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
1634
        <DisplayName>Information Disclosure in scripts</DisplayName>
1635
      </AttackModulePolicy>
1636
      <AttackModulePolicy>
1637
        <Enabled>1</Enabled>
1638
        <ModuleId>07BD211A580944E591F78B40FF3F3489</ModuleId>
1639
        <ModulePriority>Low</ModulePriority>
1640
        <Severity>Informational</Severity>
1641
        <MaxVulnLimit>250</MaxVulnLimit>
1642
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1643
        <MaxVarianceLimit>3</MaxVarianceLimit>
1644
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1645
        <EnforceEncoding>0</EnforceEncoding>
1646
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1647
        <AttackPoints>Response Analysis</AttackPoints>
1648
        <ParameterLocations></ParameterLocations>
1649
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1650
        <DisplayName>Secure and non-secure content mix</DisplayName>
1651
      </AttackModulePolicy>
1652
      <AttackModulePolicy>
1653
        <Enabled>1</Enabled>
1654
        <ModuleId>1CBEA71A88844A11A4CD6ABAA2FD7F62</ModuleId>
1655
        <ModulePriority>Low</ModulePriority>
1656
        <Severity>Low</Severity>
1657
        <MaxVulnLimit>100</MaxVulnLimit>
1658
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1659
        <MaxVarianceLimit>4</MaxVarianceLimit>
1660
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1661
        <EnforceEncoding>0</EnforceEncoding>
1662
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1663
        <AttackPoints>Response Analysis</AttackPoints>
1664
        <ParameterLocations></ParameterLocations>
1665
        <RequestOriginations>HTML|Form|Silverlight</RequestOriginations>
1666
        <DisplayName>Sensitive data over an insecure channel</DisplayName>
1667
      </AttackModulePolicy>
1668
      <AttackModulePolicy>
1669
        <Enabled>1</Enabled>
1670
        <ModuleId>34A0F038EFA248B594E7F17447F4CF2E</ModuleId>
1671
        <ModulePriority>High</ModulePriority>
1672
        <Severity>Informational</Severity>
1673
        <MaxVulnLimit>10</MaxVulnLimit>
1674
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1675
        <MaxVarianceLimit>1</MaxVarianceLimit>
1676
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1677
        <EnforceEncoding>0</EnforceEncoding>
1678
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1679
        <AttackPoints>Web Site|Response Analysis</AttackPoints>
1680
        <ParameterLocations></ParameterLocations>
1681
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1682
        <DisplayName>Server Configuration</DisplayName>
1683
      </AttackModulePolicy>
1684
      <AttackModulePolicy>
1685
        <Enabled>1</Enabled>
1686
        <ModuleId>DC8E0D09314B44D39915AAF8439B4F53</ModuleId>
1687
        <ModulePriority>Medium</ModulePriority>
1688
        <Severity>Medium</Severity>
1689
        <MaxVulnLimit>150</MaxVulnLimit>
1690
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1691
        <MaxVarianceLimit>4</MaxVarianceLimit>
1692
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1693
        <EnforceEncoding>0</EnforceEncoding>
1694
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1695
        <AttackPoints>Parameter</AttackPoints>
1696
        <ParameterLocations>Directory|File|Path|Query|Fragment|Post|Cookie|Referer|Http Header</ParameterLocations>
1697
        <RequestOriginations>HTML|Form|AJAX</RequestOriginations>
1698
        <DisplayName>Server Side Include (SSI) Injection</DisplayName>
1699
      </AttackModulePolicy>
1700
      <AttackModulePolicy>
1701
        <Enabled>1</Enabled>
1702
        <ModuleId>0F5408AB9FF94320AA58FCFE80EDEF59</ModuleId>
1703
        <ModulePriority>High</ModulePriority>
1704
        <Severity>High</Severity>
1705
        <MaxVulnLimit>200</MaxVulnLimit>
1706
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1707
        <MaxVarianceLimit>4</MaxVarianceLimit>
1708
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1709
        <EnforceEncoding>0</EnforceEncoding>
1710
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1711
        <AttackPoints>Parameter</AttackPoints>
1712
        <ParameterLocations>Path|Query|Post|Cookie</ParameterLocations>
1713
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1714
        <DisplayName>Server Side Template Injection</DisplayName>
1715
      </AttackModulePolicy>
1716
      <AttackModulePolicy>
1717
        <Enabled>1</Enabled>
1718
        <ModuleId>DB1340E1857540219DF84A6A9DC0494C</ModuleId>
1719
        <ModulePriority>High</ModulePriority>
1720
        <Severity>Medium</Severity>
1721
        <MaxVulnLimit>25</MaxVulnLimit>
1722
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1723
        <MaxVarianceLimit>2</MaxVarianceLimit>
1724
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1725
        <EnforceEncoding>0</EnforceEncoding>
1726
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1727
        <AttackPoints>Web Resource</AttackPoints>
1728
        <ParameterLocations></ParameterLocations>
1729
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1730
        <DisplayName>Session Fixation</DisplayName>
1731
      </AttackModulePolicy>
1732
      <AttackModulePolicy>
1733
        <Enabled>1</Enabled>
1734
        <ModuleId>6B1B2812012D41249BDEE83FFAEB523D</ModuleId>
1735
        <ModulePriority>Low</ModulePriority>
1736
        <Severity>Low</Severity>
1737
        <MaxVulnLimit>10</MaxVulnLimit>
1738
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1739
        <MaxVarianceLimit>1</MaxVarianceLimit>
1740
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1741
        <EnforceEncoding>0</EnforceEncoding>
1742
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1743
        <AttackPoints>Parameter</AttackPoints>
1744
        <ParameterLocations>Directory|Path|Query</ParameterLocations>
1745
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
1746
        <DisplayName>HTTP Query Session Check</DisplayName>
1747
      </AttackModulePolicy>
1748
      <AttackModulePolicy>
1749
        <Enabled>1</Enabled>
1750
        <ModuleId>F729A70998064A1F99A8BEA8512D31AE</ModuleId>
1751
        <ModulePriority>Medium</ModulePriority>
1752
        <Severity>Low</Severity>
1753
        <MaxVulnLimit>10</MaxVulnLimit>
1754
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1755
        <MaxVarianceLimit>4</MaxVarianceLimit>
1756
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1757
        <EnforceEncoding>0</EnforceEncoding>
1758
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1759
        <AttackPoints>Web Resource</AttackPoints>
1760
        <ParameterLocations></ParameterLocations>
1761
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1762
        <DisplayName>Session Strength</DisplayName>
1763
      </AttackModulePolicy>
1764
      <AttackModulePolicy>
1765
        <Enabled>1</Enabled>
1766
        <ModuleId>0DB2C1311DA74B80A153A8733C74D6CC</ModuleId>
1767
        <ModulePriority>Medium</ModulePriority>
1768
        <Severity>Low</Severity>
1769
        <MaxVulnLimit>50</MaxVulnLimit>
1770
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1771
        <MaxVarianceLimit>4</MaxVarianceLimit>
1772
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1773
        <EnforceEncoding>0</EnforceEncoding>
1774
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1775
        <AttackPoints>Response Analysis</AttackPoints>
1776
        <ParameterLocations></ParameterLocations>
1777
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1778
        <DisplayName>Session Upgrade</DisplayName>
1779
      </AttackModulePolicy>
1780
      <AttackModulePolicy>
1781
        <Enabled>1</Enabled>
1782
        <ModuleId>7A7B3239AB8146839A8AEF170807ED1E</ModuleId>
1783
        <ModulePriority>Low</ModulePriority>
1784
        <Severity>Medium</Severity>
1785
        <MaxVulnLimit>100</MaxVulnLimit>
1786
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1787
        <MaxVarianceLimit>4</MaxVarianceLimit>
1788
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1789
        <EnforceEncoding>0</EnforceEncoding>
1790
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1791
        <AttackPoints>File</AttackPoints>
1792
        <ParameterLocations></ParameterLocations>
1793
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1794
        <DisplayName>Source Code Disclosure</DisplayName>
1795
      </AttackModulePolicy>
1796
      <AttackModulePolicy>
1797
        <Enabled>1</Enabled>
1798
        <ModuleId>59646365E0E44520BE4297C3ABAA7E75</ModuleId>
1799
        <ModulePriority>High</ModulePriority>
1800
        <Severity>Low</Severity>
1801
        <MaxVulnLimit>250</MaxVulnLimit>
1802
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1803
        <MaxVarianceLimit>4</MaxVarianceLimit>
1804
        <PassiveAnalysisOnAttacks>1</PassiveAnalysisOnAttacks>
1805
        <EnforceEncoding>0</EnforceEncoding>
1806
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1807
        <AttackPoints>Response Analysis</AttackPoints>
1808
        <ParameterLocations></ParameterLocations>
1809
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1810
        <DisplayName>SQL Information Leakage</DisplayName>
1811
      </AttackModulePolicy>
1812
      <AttackModulePolicy>
1813
        <Enabled>1</Enabled>
1814
        <ModuleId>B6F559D374B5451EB424A1C1FB264FA6</ModuleId>
1815
        <ModulePriority>High</ModulePriority>
1816
        <Severity>High</Severity>
1817
        <MaxVulnLimit>500</MaxVulnLimit>
1818
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1819
        <MaxVarianceLimit>4</MaxVarianceLimit>
1820
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1821
        <EnforceEncoding>0</EnforceEncoding>
1822
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1823
        <AttackPoints>Parameter</AttackPoints>
1824
        <ParameterLocations>Directory|File|Path|Query|Post|Cookie|Referer|Http Header</ParameterLocations>
1825
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1826
        <DisplayName>SQL Injection</DisplayName>
1827
      </AttackModulePolicy>
1828
      <AttackModulePolicy>
1829
        <Enabled>1</Enabled>
1830
        <ModuleId>0496353D92704F2E942BFE1B575D9B7C</ModuleId>
1831
        <ModulePriority>High</ModulePriority>
1832
        <Severity>High</Severity>
1833
        <MaxVulnLimit>25</MaxVulnLimit>
1834
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1835
        <MaxVarianceLimit>4</MaxVarianceLimit>
1836
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1837
        <EnforceEncoding>0</EnforceEncoding>
1838
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1839
        <AttackPoints>Parameter</AttackPoints>
1840
        <ParameterLocations>Path|Query|Post</ParameterLocations>
1841
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1842
        <DisplayName>SQL Injection Auth Bypass</DisplayName>
1843
      </AttackModulePolicy>
1844
      <AttackModulePolicy>
1845
        <Enabled>1</Enabled>
1846
        <ModuleId>CEB40EE490564D60B4F9B3CE79C009B5</ModuleId>
1847
        <ModulePriority>Medium</ModulePriority>
1848
        <Severity>Medium</Severity>
1849
        <MaxVulnLimit>100</MaxVulnLimit>
1850
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1851
        <MaxVarianceLimit>4</MaxVarianceLimit>
1852
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1853
        <EnforceEncoding>0</EnforceEncoding>
1854
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1855
        <AttackPoints>Response Analysis</AttackPoints>
1856
        <ParameterLocations></ParameterLocations>
1857
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1858
        <DisplayName>SQL Parameter Check</DisplayName>
1859
      </AttackModulePolicy>
1860
      <AttackModulePolicy>
1861
        <Enabled>1</Enabled>
1862
        <ModuleId>C5805272001249A095A48F2E56240C10</ModuleId>
1863
        <ModulePriority>Medium</ModulePriority>
1864
        <Severity>Informational</Severity>
1865
        <MaxVulnLimit>25</MaxVulnLimit>
1866
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1867
        <MaxVarianceLimit>1</MaxVarianceLimit>
1868
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1869
        <EnforceEncoding>0</EnforceEncoding>
1870
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1871
        <AttackPoints>Web Site</AttackPoints>
1872
        <ParameterLocations></ParameterLocations>
1873
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1874
        <DisplayName>SSL Strength</DisplayName>
1875
      </AttackModulePolicy>
1876
      <AttackModulePolicy>
1877
        <Enabled>1</Enabled>
1878
        <ModuleId>5D9A66E5961B4644AAF5EC655E18EE66</ModuleId>
1879
        <ModulePriority>Medium</ModulePriority>
1880
        <Severity>Informational</Severity>
1881
        <MaxVulnLimit>50</MaxVulnLimit>
1882
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1883
        <MaxVarianceLimit>20</MaxVarianceLimit>
1884
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1885
        <EnforceEncoding>0</EnforceEncoding>
1886
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1887
        <AttackPoints>Web Site</AttackPoints>
1888
        <ParameterLocations></ParameterLocations>
1889
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1890
        <DisplayName>Subdomain discovery</DisplayName>
1891
      </AttackModulePolicy>
1892
      <AttackModulePolicy>
1893
        <Enabled>1</Enabled>
1894
        <ModuleId>9A22444AC7C642ABBC598CBCA4738C3B</ModuleId>
1895
        <ModulePriority>High</ModulePriority>
1896
        <Severity>Medium</Severity>
1897
        <MaxVulnLimit>40</MaxVulnLimit>
1898
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1899
        <MaxVarianceLimit>4</MaxVarianceLimit>
1900
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1901
        <EnforceEncoding>0</EnforceEncoding>
1902
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1903
        <AttackPoints>Parameter</AttackPoints>
1904
        <ParameterLocations>Path|Query|Post|Cookie</ParameterLocations>
1905
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1906
        <DisplayName>Unvalidated Redirect</DisplayName>
1907
      </AttackModulePolicy>
1908
      <AttackModulePolicy>
1909
        <Enabled>1</Enabled>
1910
        <ModuleId>B69E83831D26496BB2CC0C0D70181EC3</ModuleId>
1911
        <ModulePriority>High</ModulePriority>
1912
        <Severity>Low</Severity>
1913
        <MaxVulnLimit>40</MaxVulnLimit>
1914
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1915
        <MaxVarianceLimit>4</MaxVarianceLimit>
1916
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1917
        <EnforceEncoding>0</EnforceEncoding>
1918
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1919
        <AttackPoints>Response Analysis</AttackPoints>
1920
        <ParameterLocations></ParameterLocations>
1921
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1922
        <DisplayName>URL rewriting</DisplayName>
1923
      </AttackModulePolicy>
1924
      <AttackModulePolicy>
1925
        <Enabled>1</Enabled>
1926
        <ModuleId>4DE84100F31849A7B845FE5F62D2FD7A</ModuleId>
1927
        <ModulePriority>Medium</ModulePriority>
1928
        <Severity>Medium</Severity>
1929
        <MaxVulnLimit>25</MaxVulnLimit>
1930
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1931
        <MaxVarianceLimit>2</MaxVarianceLimit>
1932
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1933
        <EnforceEncoding>0</EnforceEncoding>
1934
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1935
        <AttackPoints>Response Analysis</AttackPoints>
1936
        <ParameterLocations></ParameterLocations>
1937
        <RequestOriginations>HTML|Form</RequestOriginations>
1938
        <DisplayName>ASP.NET ViewState security</DisplayName>
1939
      </AttackModulePolicy>
1940
      <AttackModulePolicy>
1941
        <Enabled>1</Enabled>
1942
        <ModuleId>0BE4C251F44C4CF1924104ADFD86289C</ModuleId>
1943
        <ModulePriority>Low</ModulePriority>
1944
        <Severity>Informational</Severity>
1945
        <MaxVulnLimit>100</MaxVulnLimit>
1946
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1947
        <MaxVarianceLimit>4</MaxVarianceLimit>
1948
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1949
        <EnforceEncoding>0</EnforceEncoding>
1950
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1951
        <AttackPoints>Web Resource</AttackPoints>
1952
        <ParameterLocations></ParameterLocations>
1953
        <RequestOriginations>HTML|Form|Flash|Silverlight</RequestOriginations>
1954
        <DisplayName>Web Beacon</DisplayName>
1955
      </AttackModulePolicy>
1956
      <AttackModulePolicy>
1957
        <Enabled>1</Enabled>
1958
        <ModuleId>667629EC1FDC4C6D98B5F4031717BB9B</ModuleId>
1959
        <ModulePriority>Medium</ModulePriority>
1960
        <Severity>Low</Severity>
1961
        <MaxVulnLimit>250</MaxVulnLimit>
1962
        <MaxPerWebSiteVulnLimit>50</MaxPerWebSiteVulnLimit>
1963
        <MaxVarianceLimit>4</MaxVarianceLimit>
1964
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1965
        <EnforceEncoding>0</EnforceEncoding>
1966
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1967
        <AttackPoints>Directory</AttackPoints>
1968
        <ParameterLocations></ParameterLocations>
1969
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST|RecrawlTraffic</RequestOriginations>
1970
        <DisplayName>Web DAV Flaws Check</DisplayName>
1971
      </AttackModulePolicy>
1972
      <AttackModulePolicy>
1973
        <Enabled>1</Enabled>
1974
        <ModuleId>74FB936F2BBA499F8D0AF3B7A29B4F9E</ModuleId>
1975
        <ModulePriority>High</ModulePriority>
1976
        <Severity>Low</Severity>
1977
        <MaxVulnLimit>30</MaxVulnLimit>
1978
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1979
        <MaxVarianceLimit>4</MaxVarianceLimit>
1980
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1981
        <EnforceEncoding>0</EnforceEncoding>
1982
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1983
        <AttackPoints>Web Site</AttackPoints>
1984
        <ParameterLocations></ParameterLocations>
1985
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1986
        <DisplayName>Cross-site tracing (XST)</DisplayName>
1987
      </AttackModulePolicy>
1988
      <AttackModulePolicy>
1989
        <Enabled>1</Enabled>
1990
        <ModuleId>377030BFE58A4F01A112295D32A0744C</ModuleId>
1991
        <ModulePriority>High</ModulePriority>
1992
        <Severity>Medium</Severity>
1993
        <MaxVulnLimit>250</MaxVulnLimit>
1994
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1995
        <MaxVarianceLimit>4</MaxVarianceLimit>
1996
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1997
        <EnforceEncoding>0</EnforceEncoding>
1998
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
1999
        <AttackPoints>Parameter</AttackPoints>
2000
        <ParameterLocations>Post</ParameterLocations>
2001
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
2002
        <DisplayName>Web Service Parameter Fuzzing</DisplayName>
2003
      </AttackModulePolicy>
2004
      <AttackModulePolicy>
2005
        <Enabled>1</Enabled>
2006
        <ModuleId>8399FA8EDF5C41BC9D3CF85DC23DC26B</ModuleId>
2007
        <ModulePriority>Low</ModulePriority>
2008
        <Severity>Informational</Severity>
2009
        <MaxVulnLimit>20</MaxVulnLimit>
2010
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
2011
        <MaxVarianceLimit>2</MaxVarianceLimit>
2012
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
2013
        <EnforceEncoding>0</EnforceEncoding>
2014
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
2015
        <AttackPoints>Response Analysis</AttackPoints>
2016
        <ParameterLocations></ParameterLocations>
2017
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
2018
        <DisplayName>X-Content-Type-Options</DisplayName>
2019
      </AttackModulePolicy>
2020
      <AttackModulePolicy>
2021
        <Enabled>1</Enabled>
2022
        <ModuleId>3E2E60F7D0E04D8596918C2D1F639064</ModuleId>
2023
        <ModulePriority>Low</ModulePriority>
2024
        <Severity>Informational</Severity>
2025
        <MaxVulnLimit>50</MaxVulnLimit>
2026
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
2027
        <MaxVarianceLimit>2</MaxVarianceLimit>
2028
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
2029
        <EnforceEncoding>0</EnforceEncoding>
2030
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
2031
        <AttackPoints>Response Analysis</AttackPoints>
2032
        <ParameterLocations></ParameterLocations>
2033
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
2034
        <DisplayName>X-Frame-Options</DisplayName>
2035
      </AttackModulePolicy>
2036
      <AttackModulePolicy>
2037
        <Enabled>1</Enabled>
2038
        <ModuleId>615D72F401BC447AB4A2139654BC9945</ModuleId>
2039
        <ModulePriority>Low</ModulePriority>
2040
        <Severity>Informational</Severity>
2041
        <MaxVulnLimit>25</MaxVulnLimit>
2042
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
2043
        <MaxVarianceLimit>2</MaxVarianceLimit>
2044
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
2045
        <EnforceEncoding>0</EnforceEncoding>
2046
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
2047
        <AttackPoints>Response Analysis</AttackPoints>
2048
        <ParameterLocations></ParameterLocations>
2049
        <RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
2050
        <DisplayName>X-XSS-Protection</DisplayName>
2051
      </AttackModulePolicy>
2052
      <AttackModulePolicy>
2053
        <Enabled>1</Enabled>
2054
        <ModuleId>ABFA075919804435A25A22A8CAC191DF</ModuleId>
2055
        <ModulePriority>High</ModulePriority>
2056
        <Severity>Medium</Severity>
2057
        <MaxVulnLimit>100</MaxVulnLimit>
2058
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
2059
        <MaxVarianceLimit>4</MaxVarianceLimit>
2060
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
2061
        <EnforceEncoding>0</EnforceEncoding>
2062
        <ApplyPolicySeverity>0</ApplyPolicySeverity>
2063
        <AttackPoints>Parameter</AttackPoints>
2064
        <ParameterLocations>Path|Query|Post|Cookie</ParameterLocations>
2065
        <RequestOriginations>HTML|Form|AJAX</RequestOriginations>
2066
        <DisplayName>XML External Entity Attack</DisplayName>
2067
      </AttackModulePolicy>
2068
      <AttackModulePolicy>
2069
        <Enabled>1</Enabled>
2070
        <ModuleId>BBE9F36A88A944ECB837D5193D356E4C</ModuleId>
2071
        <ModulePriority>Medium</ModulePriority>
2072
        <Severity>High</Severity>
2073
        <MaxVulnLimit>100</MaxVulnLimit>
2074
        <MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
2075
        <MaxVarianceLimit>4</MaxVarianceLimit>
2076
        <PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
2077
        <EnforceEncoding>0