Advanced Scan Configuration

There are several ways to create or edit a Scan Configuration.

In this article we will go over accessing the advanced options within AppSpider and using the Scan configuration file.

Advanced options settings

The panel allows you to configure the advanced options. You may sort the settings by name, value, or description.

This panel contains the same information located in the Scan configuration XML file.

Scan configuration XML file

You can edit an existing scan configuration file or provide a new custom file.

AppSpider Scan Configuration File

File structure

The Scan Configuration file is an XML file and has a hierarchical structure. The top-level data structure in the file is ScanConfig. Everything else in the file resides below ScanConfig in the hierarchy.

There are 3 types of elements in the Scan configuration file:

  • Scalar - Options that have a single value. For example, ScanName.
  • Composite Object - An object that can contain other heterogeneous elements such as Scalars, Composite Objects and Lists. For example, the top-level object in the Scan Configuration file, the ScanConfig object is a Composite Object.
  • List - Options that can have a list of values. Lists cannot contain other Lists directly.

Scalar types

Scalar values in the Scan configuration file can be of 1 of the following types:

  • String - A String type.
  • LargeString - A String type optimized for large strings
  • UniqueString - A string type optimized for string that most likely be repeated multiple times.
  • LargeUniqueString - A string type optimized for large strings that a likely to be repeated multiple times.
  • LargeCompressedString - A string type that store strings in compressed form.
  • ByteNumber - A one-byte number
  • WordNumber - A two-byte number
  • Number - A four-byte number
  • LargeNumber - An eight-byte number
  • Enumeration - A data type consisted on named predefined values.
  • Float - A four-byte floating point number
  • Double - An eight-byte floating point number
  • Boolean - A boolean type. Boolean is not an enumerated type; it is stored as a Number with values either 0 or 1.
    • 1 = TRUE
    • 0 = FALSE
  • Date - Store Date data. It is stored in the format YYYY-MM-DD HH:MM:SS
  • Duration - Store time duration data. It is stored in the format [DD Day[s]] HH:MM::SS, where DD is the number of days, and square brackets show optional elements.

Enumerated types

Many Scalar elements in the Scan configuration file have Enumeration types. Enumeration type is stored as an integer but allows a user to reference integer values by their symbolic name. An enumerated type value can be set using either its numeric or symbolic form. For example, the following 2 lines from Scan configuration file are equivalent because 'High' is enumerated value defines as '4'.

xml
1
<Severity>High</Severity>
2
<Severity>4</Severity>

Bitmasks

Some Enumerated Types can be BitMasks, where the value of an element is defined by several bits. Enumerated values of BitMasks are defined so they do not have same bit set and can be used in a bitwise-OR operation to produce the final value. Multiple bits that are set in the bitmask are separated with character '|' for example:

xml
1
<AttackPoints>Directory|File|Parameter</AttackPoints>

For Enumerated Types, the values of the Bitmasks can be set using either numeric or symbolic form. The following 2 lines below are equivalent because value Parameter is defined as 16.

xml
1
<AttackPoints>Directory|File|Parameter</AttackPoints>
2
<AttackPoints>Directory|File|16</AttackPoints>

Default values

When a new Scan configuration file is created all Scalar Elements are assigned their default values. Default values are configured so that they produce best results for majority of web sites. Even if an element is not present in the Scan configuration file AppSpider will use the default value of the element.

Scan configuration schema changes

AppSpider development is an ongoing process. Developers frequently come across new types of web sites that require some special treatment and require new ways of configuring a scan execution. As a result, the number of parameters in the Scan configuration increases with every major release of AppSpider. To avoid any problems with Scan Configuration files created by the previous versions of AppSpider or by user's programs only new elements are added to the scan configuration files and all existing elements and their meaning are preserved.

XML file example

When you create or export a ScanConfig file it generated a file with the objects and fields.

To get more information on what is in each object see Scan Configuration Parameters.

XML File example
xml
1
<?xml version="1.0"?>
2
<ScanConfig>
3
<Name>webscantest</Name>
4
<AppVersion>7.0</AppVersion>
5
<Log>1</Log>
6
<DetailedLogging>0</DetailedLogging>
7
<IncludeTraffic>0</IncludeTraffic>
8
<WindowsErrors>0</WindowsErrors>
9
<UseSystemDsn>0</UseSystemDsn>
10
<Recrawl>0</Recrawl>
11
<PauseOnRecoverableError>1</PauseOnRecoverableError>
12
<ExecuteCommandLineURL></ExecuteCommandLineURL>
13
<NotifyScanDoneURL></NotifyScanDoneURL>
14
<JavaScriptEngine>Chrome</JavaScriptEngine>
15
<MaxDatabaseSize>1073741824</MaxDatabaseSize>
16
<MaxTrafficFiles>0</MaxTrafficFiles>
17
<CrawlConfig>
18
<MaxDomain>100</MaxDomain>
19
<MaxCrawlResults>5000</MaxCrawlResults>
20
<MaxPerWebSiteCrawlResults>-1</MaxPerWebSiteCrawlResults>
21
<MaxPerDirCrawlResults>500</MaxPerDirCrawlResults>
22
<MaxPerLinkCrawlResults>50</MaxPerLinkCrawlResults>
23
<MaxPerNormalizedLinkCrawlResult>100</MaxPerNormalizedLinkCrawlResult>
24
<MaxPerDirChildNodes>300</MaxPerDirChildNodes>
25
<MaxBlackListExtCrawlResults>100</MaxBlackListExtCrawlResults>
26
<MaxAttackFeedbackLinksCount>300</MaxAttackFeedbackLinksCount>
27
<MaxPerFileNameCrawlResults>250</MaxPerFileNameCrawlResults>
28
<MaxPerQueryCrawlResults>400</MaxPerQueryCrawlResults>
29
<RecursionDepth>2</RecursionDepth>
30
<MaxDirDepth>15</MaxDirDepth>
31
<DiscoveryDepth>-1</DiscoveryDepth>
32
<UrlRepetitionTolerance>25</UrlRepetitionTolerance>
33
<SequenceRepetitionTolerance>5</SequenceRepetitionTolerance>
34
<MaxReportedImages>500</MaxReportedImages>
35
<MaxReportedLinks>2500</MaxReportedLinks>
36
<MaxReportedComments>500</MaxReportedComments>
37
<MaxReportedScripts>500</MaxReportedScripts>
38
<MaxReportedEmails>500</MaxReportedEmails>
39
<MaxReportedForms>500</MaxReportedForms>
40
<MaxBrowserPageWaitTimeout>60000</MaxBrowserPageWaitTimeout>
41
<MaxBrowserWaitTillRequestTimeout>4000</MaxBrowserWaitTillRequestTimeout>
42
<MaxBrowserDOMDepth>4</MaxBrowserDOMDepth>
43
<MaxBrowserEventsPerLink>600</MaxBrowserEventsPerLink>
44
<MaxBrowserEventsPerCrawlResult>400</MaxBrowserEventsPerCrawlResult>
45
<MaxBrowserEventsPerDOM>100</MaxBrowserEventsPerDOM>
46
<MaxBrowserNoNewResourceDOMCount>400</MaxBrowserNoNewResourceDOMCount>
47
<NotInsertedLinkCountThreshold>2</NotInsertedLinkCountThreshold>
48
<MaxCookiesFromJavascript>100</MaxCookiesFromJavascript>
49
<MaxCookiesSameNameFromJavascript>10</MaxCookiesSameNameFromJavascript>
50
<MaxDaysThresholdGoodTraffic>7</MaxDaysThresholdGoodTraffic>
51
<CrawlPrioritization>Smart</CrawlPrioritization>
52
<FileNotFoundRegex>(page|resource) (you requested )?(was not|cannot be) found|Page not found|404(.0)? - ((File (or directory )?not found)|(Not Found))|HTTP Status 404|404 Not Found</FileNotFoundRegex>
53
<ServerErrorRegex></ServerErrorRegex>
54
<InvalidURLRegexAttack><![CDATA[['"\(\)<>]|\d([-+]|%2[bd])\d|repeat\(|alert\(|/x\w{7}\.txt|window.location|%20(AND|OR)%20|%3cscript|(ping|echo)%20|javascript(%3a|:)|%0d%0a]]></InvalidURLRegexAttack>
55
<InvalidURLRegexCrawl><![CDATA[(([ ]|%20)(MOD|ASC|DESC)([ ]|%20)|(<|%3c)(a|div|script|style|iframe|img|svg)|[?&=]x[a-z0-9]{7}$|C=N;O=D|\?C=M)|(ping|echo)%20|javascript(%3a|:)|%0d%0ax]]></InvalidURLRegexCrawl>
56
<PriorityLinksRegex>(auth|log[ -]?(in|on)|sign[ -]?(in|on)|profile|account|transfer|admin)</PriorityLinksRegex>
57
<LockCookies>0</LockCookies>
58
<CaseSensitivity>Case Sensitive</CaseSensitivity>
59
<UniqueUrlsAcrossWebsites>0</UniqueUrlsAcrossWebsites>
60
<SaveReferences>0</SaveReferences>
61
<UseBrowser>1</UseBrowser>
62
<ShowBrowser>0</ShowBrowser>
63
<StayOnPort>0</StayOnPort>
64
<RestrictToMacro>0</RestrictToMacro>
65
<RestrictToManualCrawling>0</RestrictToManualCrawling>
66
<RestrictToSeedList>0</RestrictToSeedList>
67
<RestrictToWebService>0</RestrictToWebService>
68
<RestrictToSelenium>0</RestrictToSelenium>
69
<RestrictToSwagger>0</RestrictToSwagger>
70
<ImportCookiesFromTraffic>0</ImportCookiesFromTraffic>
71
<PageEqualThreshhold>0.95</PageEqualThreshhold>
72
<PageSimilarThreshhold>0.8</PageSimilarThreshhold>
73
<ExperimentalCrawling>Disabled</ExperimentalCrawling>
74
<Flash>1</Flash>
75
<EnableAdvancedParsers>1</EnableAdvancedParsers>
76
<SearchForUrls>1</SearchForUrls>
77
<CookieCommaSeparator>1</CookieCommaSeparator>
78
<MaxWebResourcesOverhead>1000</MaxWebResourcesOverhead>
79
<BlacklistContactForms>0</BlacklistContactForms>
80
<FrameworksCrawlConfig>
81
<EnableFrameworksCrawling>1</EnableFrameworksCrawling>
82
<FrameworkConfigList>
83
<FrameworkConfig>
84
<Name>ReactJS</Name>
85
<DefaultConfigVersion>2</DefaultConfigVersion>
86
<Enabled>1</Enabled>
87
<HEAD>1</HEAD>
88
<DetectionRegex>createReactRootIndex</DetectionRegex>
89
<HealthcheckString>react</HealthcheckString>
90
<FileName>fm.react.min.js</FileName>
91
<GetAllEventsScript>window.fm.react.getAllEvents('appspider');</GetAllEventsScript>
92
<GetAllEventsDelay>0</GetAllEventsDelay>
93
<GetVersionStringScript></GetVersionStringScript>
94
</FrameworkConfig>
95
<FrameworkConfig>
96
<Name>AngularJS</Name>
97
<DefaultConfigVersion>1</DefaultConfigVersion>
98
<Enabled>1</Enabled>
99
<HEAD>0</HEAD>
100
<DetectionRegex>ng-controller</DetectionRegex>
101
<HealthcheckString>angular</HealthcheckString>
102
<FileName>angular-hook-bundle.min.js</FileName>
103
<GetAllEventsScript>NG_HOOK.getAllNgEvents();</GetAllEventsScript>
104
<GetAllEventsDelay>0</GetAllEventsDelay>
105
<GetVersionStringScript>NG_HOOK.getVersionString();</GetVersionStringScript>
106
</FrameworkConfig>
107
<FrameworkConfig>
108
<Name>KnockoutJS</Name>
109
<DefaultConfigVersion>1</DefaultConfigVersion>
110
<Enabled>1</Enabled>
111
<HEAD>0</HEAD>
112
<DetectionRegex>data-bind</DetectionRegex>
113
<HealthcheckString>ko</HealthcheckString>
114
<FileName>ko-hook-bundle.min.js</FileName>
115
<GetAllEventsScript>KO_HOOK.getAllKOEvents();</GetAllEventsScript>
116
<GetAllEventsDelay>5000</GetAllEventsDelay>
117
<GetVersionStringScript>KO_HOOK.getVersionString();</GetVersionStringScript>
118
</FrameworkConfig>
119
<FrameworkConfig>
120
<Name>AngularLib</Name>
121
<DefaultConfigVersion>2</DefaultConfigVersion>
122
<Enabled>1</Enabled>
123
<HEAD>0</HEAD>
124
<DetectionRegex>(?-i)angular(?!\w)</DetectionRegex>
125
<HealthcheckString></HealthcheckString>
126
<FileName>angular-4-hook-bundle.min.js</FileName>
127
<GetAllEventsScript>NG_HOOK_LIB.getAllAngularFmEvents();</GetAllEventsScript>
128
<GetAllEventsDelay>5000</GetAllEventsDelay>
129
<GetVersionStringScript>NG_HOOK_LIB.getVersionString();</GetVersionStringScript>
130
</FrameworkConfig>
131
<FrameworkConfig>
132
<Name>ReactLib</Name>
133
<DefaultConfigVersion>1</DefaultConfigVersion>
134
<Enabled>1</Enabled>
135
<HEAD>0</HEAD>
136
<DetectionRegex>react-text</DetectionRegex>
137
<HealthcheckString></HealthcheckString>
138
<FileName>react-hook-bundle.min.js</FileName>
139
<GetAllEventsScript>REACT_HOOK_LIB.getAllReactEvents();</GetAllEventsScript>
140
<GetAllEventsDelay>5000</GetAllEventsDelay>
141
<GetVersionStringScript>REACT_HOOK_LIB.getVersionString();</GetVersionStringScript>
142
</FrameworkConfig>
143
<FrameworkConfig>
144
<Name>ReactTwo</Name>
145
<DefaultConfigVersion>1</DefaultConfigVersion>
146
<Enabled>1</Enabled>
147
<HEAD>0</HEAD>
148
<DetectionRegex>(?-i)"react[.][a-df-z][a-z]+"</DetectionRegex>
149
<HealthcheckString></HealthcheckString>
150
<FileName>react-hook-bundle.min.js</FileName>
151
<GetAllEventsScript>REACT_HOOK_LIB.getAllReactTwoEvents();</GetAllEventsScript>
152
<GetAllEventsDelay>5000</GetAllEventsDelay>
153
<GetVersionStringScript>REACT_HOOK_LIB.getVersionString();</GetVersionStringScript>
154
</FrameworkConfig>
155
<FrameworkConfig>
156
<Name>OpenUI5</Name>
157
<DefaultConfigVersion>1</DefaultConfigVersion>
158
<Enabled>1</Enabled>
159
<HEAD>0</HEAD>
160
<DetectionRegex>(?-i)sap-ui-debug</DetectionRegex>
161
<HealthcheckString></HealthcheckString>
162
<FileName>sap-open-ui5-hook-bundle.min.js</FileName>
163
<GetAllEventsScript>OPEN_UI5_HOOK_LIB.getAllOPENUI5Events();</GetAllEventsScript>
164
<GetAllEventsDelay>5000</GetAllEventsDelay>
165
<GetVersionStringScript>OPEN_UI5_HOOK_LIB.getVersionString();</GetVersionStringScript>
166
</FrameworkConfig>
167
<FrameworkConfig>
168
<Name>Vue</Name>
169
<DefaultConfigVersion>1</DefaultConfigVersion>
170
<Enabled>1</Enabled>
171
<HEAD>0</HEAD>
172
<DetectionRegex>(?-i)__VUE_SSR_CONTEXT__</DetectionRegex>
173
<HealthcheckString></HealthcheckString>
174
<FileName>vue-hook-bundle.min.js</FileName>
175
<GetAllEventsScript>VUE_HOOK_LIB.getAllVueEvents();</GetAllEventsScript>
176
<GetAllEventsDelay>5000</GetAllEventsDelay>
177
<GetVersionStringScript>VUE_HOOK_LIB.getVersionString();</GetVersionStringScript>
178
</FrameworkConfig>
179
<FrameworkConfig>
180
<Name>Ember</Name>
181
<DefaultConfigVersion>1</DefaultConfigVersion>
182
<Enabled>1</Enabled>
183
<HEAD>0</HEAD>
184
<DetectionRegex>(?-i)EMBER_LOAD_HOOKS</DetectionRegex>
185
<HealthcheckString></HealthcheckString>
186
<FileName>ember-hook-bundle.min.js</FileName>
187
<GetAllEventsScript>EMBER_HOOK_LIB.getAllEmberEvents();</GetAllEventsScript>
188
<GetAllEventsDelay>5000</GetAllEventsDelay>
189
<GetVersionStringScript>EMBER_HOOK_LIB.getVersionString();</GetVersionStringScript>
190
</FrameworkConfig>
191
<FrameworkConfig>
192
<Name>Backbone</Name>
193
<DefaultConfigVersion>1</DefaultConfigVersion>
194
<Enabled>1</Enabled>
195
<HEAD>0</HEAD>
196
<DetectionRegex>(?-i)Backbone</DetectionRegex>
197
<HealthcheckString></HealthcheckString>
198
<FileName>backbone-hook-bundle.min.js</FileName>
199
<GetAllEventsScript>BACKBONE_HOOK_LIB.getAllBackboneEvents();</GetAllEventsScript>
200
<GetAllEventsDelay>5000</GetAllEventsDelay>
201
<GetVersionStringScript>BACKBONE_HOOK_LIB.getVersionString();</GetVersionStringScript>
202
</FrameworkConfig>
203
</FrameworkConfigList>
204
</FrameworksCrawlConfig>
205
<SeedUrlList>
206
<SeedUrl>
207
<Value>http://www.webscantest.com/</Value>
208
</SeedUrl>
209
</SeedUrlList>
210
<ScopeConstraintList>
211
<ScopeConstraint>
212
<URL>http://www.webscantest.com/*</URL>
213
<Method>All</Method>
214
<MatchCriteria>Wildcard</MatchCriteria>
215
<Exclusion>Include</Exclusion>
216
</ScopeConstraint>
217
<ScopeConstraint>
218
<URL>http://*.www.webscantest.com/*</URL>
219
<Method>All</Method>
220
<MatchCriteria>Wildcard</MatchCriteria>
221
<Exclusion>Include</Exclusion>
222
</ScopeConstraint>
223
</ScopeConstraintList>
224
<BlackListExtensionList>
225
<BlackListExtension>
226
<Value>css</Value>
227
</BlackListExtension>
228
<BlackListExtension>
229
<Value>axd</Value>
230
</BlackListExtension>
231
</BlackListExtensionList>
232
<GrayListExtensionList>
233
<GrayListExtension>
234
<Value>pdf</Value>
235
</GrayListExtension>
236
<GrayListExtension>
237
<Value>doc</Value>
238
</GrayListExtension>
239
<GrayListExtension>
240
<Value>jpg</Value>
241
</GrayListExtension>
242
<GrayListExtension>
243
<Value>jpeg</Value>
244
</GrayListExtension>
245
<GrayListExtension>
246
<Value>gif</Value>
247
</GrayListExtension>
248
<GrayListExtension>
249
<Value>png</Value>
250
</GrayListExtension>
251
<GrayListExtension>
252
<Value>bmp</Value>
253
</GrayListExtension>
254
<GrayListExtension>
255
<Value>ico</Value>
256
</GrayListExtension>
257
<GrayListExtension>
258
<Value>js</Value>
259
</GrayListExtension>
260
<GrayListExtension>
261
<Value>tiff</Value>
262
</GrayListExtension>
263
<GrayListExtension>
264
<Value>eot</Value>
265
</GrayListExtension>
266
<GrayListExtension>
267
<Value>ttf</Value>
268
</GrayListExtension>
269
<GrayListExtension>
270
<Value>mid</Value>
271
</GrayListExtension>
272
<GrayListExtension>
273
<Value>midi</Value>
274
</GrayListExtension>
275
<GrayListExtension>
276
<Value>mp3</Value>
277
</GrayListExtension>
278
<GrayListExtension>
279
<Value>mpeg</Value>
280
</GrayListExtension>
281
<GrayListExtension>
282
<Value>wav</Value>
283
</GrayListExtension>
284
<GrayListExtension>
285
<Value>avi</Value>
286
</GrayListExtension>
287
<GrayListExtension>
288
<Value>woff</Value>
289
</GrayListExtension>
290
<GrayListExtension>
291
<Value>svg</Value>
292
</GrayListExtension>
293
</GrayListExtensionList>
294
<BinaryExtensionList>
295
<BinaryExtension>
296
<Value>fla</Value>
297
</BinaryExtension>
298
<BinaryExtension>
299
<Value>swf</Value>
300
</BinaryExtension>
301
<BinaryExtension>
302
<Value>pdf</Value>
303
</BinaryExtension>
304
<BinaryExtension>
305
<Value>doc</Value>
306
</BinaryExtension>
307
<BinaryExtension>
308
<Value>jpg</Value>
309
</BinaryExtension>
310
<BinaryExtension>
311
<Value>jpeg</Value>
312
</BinaryExtension>
313
<BinaryExtension>
314
<Value>gif</Value>
315
</BinaryExtension>
316
<BinaryExtension>
317
<Value>png</Value>
318
</BinaryExtension>
319
<BinaryExtension>
320
<Value>bmp</Value>
321
</BinaryExtension>
322
<BinaryExtension>
323
<Value>ico</Value>
324
</BinaryExtension>
325
<BinaryExtension>
326
<Value>dll</Value>
327
</BinaryExtension>
328
<BinaryExtension>
329
<Value>exe</Value>
330
</BinaryExtension>
331
<BinaryExtension>
332
<Value>eot</Value>
333
</BinaryExtension>
334
<BinaryExtension>
335
<Value>ttf</Value>
336
</BinaryExtension>
337
<BinaryExtension>
338
<Value>mp3</Value>
339
</BinaryExtension>
340
<BinaryExtension>
341
<Value>mp4</Value>
342
</BinaryExtension>
343
<BinaryExtension>
344
<Value>wav</Value>
345
</BinaryExtension>
346
<BinaryExtension>
347
<Value>woff</Value>
348
</BinaryExtension>
349
<BinaryExtension>
350
<Value>svg</Value>
351
</BinaryExtension>
352
</BinaryExtensionList>
353
<TextExtensionList>
354
<TextExtension>
355
<Value>txt</Value>
356
</TextExtension>
357
<TextExtension>
358
<Value>js</Value>
359
</TextExtension>
360
<TextExtension>
361
<Value>css</Value>
362
</TextExtension>
363
<TextExtension>
364
<Value>json</Value>
365
</TextExtension>
366
</TextExtensionList>
367
<BinaryContentTypeList>
368
<BinaryContentType>
369
<Value>audio/*</Value>
370
</BinaryContentType>
371
<BinaryContentType>
372
<Value>image/*</Value>
373
</BinaryContentType>
374
<BinaryContentType>
375
<Value>video/*</Value>
376
</BinaryContentType>
377
<BinaryContentType>
378
<Value>application/pdf</Value>
379
</BinaryContentType>
380
<BinaryContentType>
381
<Value>application/zip</Value>
382
</BinaryContentType>
383
<BinaryContentType>
384
<Value>application/x-rar-compressed</Value>
385
</BinaryContentType>
386
<BinaryContentType>
387
<Value>application/x-dvi</Value>
388
</BinaryContentType>
389
<BinaryContentType>
390
<Value>application/x-shockwave-flash</Value>
391
</BinaryContentType>
392
<BinaryContentType>
393
<Value>application/msword</Value>
394
</BinaryContentType>
395
<BinaryContentType>
396
<Value>application/ogg</Value>
397
</BinaryContentType>
398
<BinaryContentType>
399
<Value>application/x-tar</Value>
400
</BinaryContentType>
401
<BinaryContentType>
402
<Value>application/octet-stream</Value>
403
</BinaryContentType>
404
</BinaryContentTypeList>
405
<HTMLContentTypeList>
406
<HTMLContentType>
407
<Value>text/html</Value>
408
</HTMLContentType>
409
<HTMLContentType>
410
<Value>html/*</Value>
411
</HTMLContentType>
412
<HTMLContentType>
413
<Value>application/xhtml+xml</Value>
414
</HTMLContentType>
415
</HTMLContentTypeList>
416
<TextContentTypeList>
417
<TextContentType>
418
<Value>text/plain</Value>
419
</TextContentType>
420
<TextContentType>
421
<Value>text/csv</Value>
422
</TextContentType>
423
<TextContentType>
424
<Value>text/css</Value>
425
</TextContentType>
426
<TextContentType>
427
<Value>text/javascript</Value>
428
</TextContentType>
429
<TextContentType>
430
<Value>application/javascript</Value>
431
</TextContentType>
432
<TextContentType>
433
<Value>application/x-javascript</Value>
434
</TextContentType>
435
<TextContentType>
436
<Value>application/json</Value>
437
</TextContentType>
438
<TextContentType>
439
<Value>application/x-httpd-php-source</Value>
440
</TextContentType>
441
</TextContentTypeList>
442
<XMLContentTypeList>
443
<XMLContentType>
444
<Value>application/xml-dtd</Value>
445
</XMLContentType>
446
<XMLContentType>
447
<Value>text/xml</Value>
448
</XMLContentType>
449
<XMLContentType>
450
<Value>application/soap+xml</Value>
451
</XMLContentType>
452
<XMLContentType>
453
<Value>application/xml</Value>
454
</XMLContentType>
455
</XMLContentTypeList>
456
<BrowserDownloadWhitelistList>
457
<BrowserDownloadWhitelist>
458
<Value>*.css</Value>
459
</BrowserDownloadWhitelist>
460
<BrowserDownloadWhitelist>
461
<Value>*.js</Value>
462
</BrowserDownloadWhitelist>
463
<BrowserDownloadWhitelist>
464
<Value>*.xml</Value>
465
</BrowserDownloadWhitelist>
466
<BrowserDownloadWhitelist>
467
<Value>*.dtd</Value>
468
</BrowserDownloadWhitelist>
469
<BrowserDownloadWhitelist>
470
<Value>*.axd</Value>
471
</BrowserDownloadWhitelist>
472
<BrowserDownloadWhitelist>
473
<Value>*.json</Value>
474
</BrowserDownloadWhitelist>
475
<BrowserDownloadWhitelist>
476
<Value>*/js/*</Value>
477
</BrowserDownloadWhitelist>
478
<BrowserDownloadWhitelist>
479
<Value>*/css/*</Value>
480
</BrowserDownloadWhitelist>
481
</BrowserDownloadWhitelistList>
482
<BrowserDoNotDownloadExtensionList>
483
<BrowserDoNotDownloadExtension>
484
<Value>pdf</Value>
485
</BrowserDoNotDownloadExtension>
486
<BrowserDoNotDownloadExtension>
487
<Value>doc</Value>
488
</BrowserDoNotDownloadExtension>
489
<BrowserDoNotDownloadExtension>
490
<Value>jpg</Value>
491
</BrowserDoNotDownloadExtension>
492
<BrowserDoNotDownloadExtension>
493
<Value>jpeg</Value>
494
</BrowserDoNotDownloadExtension>
495
<BrowserDoNotDownloadExtension>
496
<Value>gif</Value>
497
</BrowserDoNotDownloadExtension>
498
<BrowserDoNotDownloadExtension>
499
<Value>png</Value>
500
</BrowserDoNotDownloadExtension>
501
<BrowserDoNotDownloadExtension>
502
<Value>bmp</Value>
503
</BrowserDoNotDownloadExtension>
504
<BrowserDoNotDownloadExtension>
505
<Value>ico</Value>
506
</BrowserDoNotDownloadExtension>
507
<BrowserDoNotDownloadExtension>
508
<Value>exe</Value>
509
</BrowserDoNotDownloadExtension>
510
<BrowserDoNotDownloadExtension>
511
<Value>swf</Value>
512
</BrowserDoNotDownloadExtension>
513
<BrowserDoNotDownloadExtension>
514
<Value>mp3</Value>
515
</BrowserDoNotDownloadExtension>
516
<BrowserDoNotDownloadExtension>
517
<Value>mp4</Value>
518
</BrowserDoNotDownloadExtension>
519
<BrowserDoNotDownloadExtension>
520
<Value>wav</Value>
521
</BrowserDoNotDownloadExtension>
522
<BrowserDoNotDownloadExtension>
523
<Value>eot</Value>
524
</BrowserDoNotDownloadExtension>
525
<BrowserDoNotDownloadExtension>
526
<Value>ttf</Value>
527
</BrowserDoNotDownloadExtension>
528
<BrowserDoNotDownloadExtension>
529
<Value>woff</Value>
530
</BrowserDoNotDownloadExtension>
531
<BrowserDoNotDownloadExtension>
532
<Value>ico</Value>
533
</BrowserDoNotDownloadExtension>
534
<BrowserDoNotDownloadExtension>
535
<Value>svg</Value>
536
</BrowserDoNotDownloadExtension>
537
</BrowserDoNotDownloadExtensionList>
538
<BrowserDoNotDownloadContentTypeList>
539
<BrowserDoNotDownloadContentType>
540
<Value>audio/*</Value>
541
</BrowserDoNotDownloadContentType>
542
<BrowserDoNotDownloadContentType>
543
<Value>image/*</Value>
544
</BrowserDoNotDownloadContentType>
545
<BrowserDoNotDownloadContentType>
546
<Value>video/*</Value>
547
</BrowserDoNotDownloadContentType>
548
<BrowserDoNotDownloadContentType>
549
<Value>application/pdf</Value>
550
</BrowserDoNotDownloadContentType>
551
<BrowserDoNotDownloadContentType>
552
<Value>application/zip</Value>
553
</BrowserDoNotDownloadContentType>
554
<BrowserDoNotDownloadContentType>
555
<Value>application/x-rar-compressed</Value>
556
</BrowserDoNotDownloadContentType>
557
<BrowserDoNotDownloadContentType>
558
<Value>application/x-dvi</Value>
559
</BrowserDoNotDownloadContentType>
560
<BrowserDoNotDownloadContentType>
561
<Value>application/x-shockwave-flash</Value>
562
</BrowserDoNotDownloadContentType>
563
<BrowserDoNotDownloadContentType>
564
<Value>application/msword</Value>
565
</BrowserDoNotDownloadContentType>
566
<BrowserDoNotDownloadContentType>
567
<Value>application/ogg</Value>
568
</BrowserDoNotDownloadContentType>
569
<BrowserDoNotDownloadContentType>
570
<Value>application/x-tar</Value>
571
</BrowserDoNotDownloadContentType>
572
<BrowserDoNotDownloadContentType>
573
<Value>application/octet-stream</Value>
574
</BrowserDoNotDownloadContentType>
575
</BrowserDoNotDownloadContentTypeList>
576
</CrawlConfig>
577
<AttackerConfig>
578
<ParametersToAttackBeforeLimitingAttacks>400</ParametersToAttackBeforeLimitingAttacks>
579
<LinksToAttackBeforeLimitingAttacks>200</LinksToAttackBeforeLimitingAttacks>
580
<MaxSameNameParameterAttackPoints>25</MaxSameNameParameterAttackPoints>
581
<MaxSameCookieParameterAttackPoints>15</MaxSameCookieParameterAttackPoints>
582
<MaxSameNameParameterAttackPointsPerLink>2</MaxSameNameParameterAttackPointsPerLink>
583
<MaxParameterAttackPointsPerLink>50</MaxParameterAttackPointsPerLink>
584
<MaxNormalizedSameNameParameterAttackPointsPerLink>4</MaxNormalizedSameNameParameterAttackPointsPerLink>
585
<ApplyGlobalFindingsSettings>1</ApplyGlobalFindingsSettings>
586
<ApplyCrawlerConstraints>1</ApplyCrawlerConstraints>
587
<MaxNumberOfScheduledPassiveAttacks>1000000</MaxNumberOfScheduledPassiveAttacks>
588
<MinCookieLifetimeForAttacks>3600</MinCookieLifetimeForAttacks>
589
<ExcludeLowConfidenceFindings>0</ExcludeLowConfidenceFindings>
590
<OutOfBandHost></OutOfBandHost>
591
<DefaultDoNotAttackParamList>
592
<DefaultDoNotAttackParam>
593
<ParameterName>^_*(ASP[.]NET_SessionId|VSTATE|VIEWSTATE(ENCRYPTED|FIELDCOUNT|GENERATOR|[0-9]*)|EVENT(VALIDATION|TTARGET|ARGUMENT)|COMPRESSEDVIEWSTATE|LASTFOCUS|CALLBACK(ID|FRAME|LOADSCRIPT|PARAM|INDEX)|SCROLLPOSITIONX|SCROLLPOSITIONY|utm.*|submit[.][x|y]|_ga|_gat|__utm[a|b|c|t|z|v|x])$</ParameterName>
594
<MatchCriteria>Regex</MatchCriteria>
595
</DefaultDoNotAttackParam>
596
</DefaultDoNotAttackParamList>
597
</AttackerConfig>
598
<AttackPolicyConfig>
599
<Policy>Default attack policy</Policy>
600
<AttackPrioritization>Smart</AttackPrioritization>
601
<AttackDepth>Smart</AttackDepth>
602
<EnableAdvancedAttacks>0</EnableAdvancedAttacks>
603
<FalsePositiveRegex>This web browser does not support JavaScript or JavaScript in this web browser is not enabled.</FalsePositiveRegex>
604
<FalsePositiveFindingRegex></FalsePositiveFindingRegex>
605
<RootCauseIdExcludeList></RootCauseIdExcludeList>
606
<AttackOnlyControllingHeaders>1</AttackOnlyControllingHeaders>
607
<EnforceEncoding>0</EnforceEncoding>
608
<AttackPoints>Web Site|Directory|File|Web Resource|Parameter|Response Analysis</AttackPoints>
609
<ParameterLocations>Directory|File|Path|Query|Fragment|Post|Cookie|Referer|Http Header</ParameterLocations>
610
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
611
<AttackModulePolicyList>
612
<AttackModulePolicy>
613
<Enabled>1</Enabled>
614
<ModuleId>C0B05B9C334341B180D2494235FF8F99</ModuleId>
615
<ModulePriority>High</ModulePriority>
616
<Severity>Informational</Severity>
617
<MaxVulnLimit>10</MaxVulnLimit>
618
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
619
<MaxVarianceLimit>2</MaxVarianceLimit>
620
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
621
<EnforceEncoding>0</EnforceEncoding>
622
<ApplyPolicySeverity>0</ApplyPolicySeverity>
623
<AttackPoints>Web Site</AttackPoints>
624
<ParameterLocations></ParameterLocations>
625
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
626
<DisplayName>Anonymous Access</DisplayName>
627
</AttackModulePolicy>
628
<AttackModulePolicy>
629
<Enabled>1</Enabled>
630
<ModuleId>59597A25A9504D5AAD20B74A4DCCABB7</ModuleId>
631
<ModulePriority>High</ModulePriority>
632
<Severity>High</Severity>
633
<MaxVulnLimit>100</MaxVulnLimit>
634
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
635
<MaxVarianceLimit>3</MaxVarianceLimit>
636
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
637
<EnforceEncoding>0</EnforceEncoding>
638
<ApplyPolicySeverity>0</ApplyPolicySeverity>
639
<AttackPoints>Directory|File|Web Resource|Parameter</AttackPoints>
640
<ParameterLocations>Directory|File|Path|Query|Fragment|Post|Cookie|Referer|Http Header</ParameterLocations>
641
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
642
<DisplayName>Apache Struts 2 Framework Checks</DisplayName>
643
</AttackModulePolicy>
644
<AttackModulePolicy>
645
<Enabled>1</Enabled>
646
<ModuleId>9F6600FB2E7840E48B156790FEFAC10A</ModuleId>
647
<ModulePriority>High</ModulePriority>
648
<Severity>Informational</Severity>
649
<MaxVulnLimit>100</MaxVulnLimit>
650
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
651
<MaxVarianceLimit>3</MaxVarianceLimit>
652
<PassiveAnalysisOnAttacks>1</PassiveAnalysisOnAttacks>
653
<EnforceEncoding>0</EnforceEncoding>
654
<ApplyPolicySeverity>0</ApplyPolicySeverity>
655
<AttackPoints>Response Analysis</AttackPoints>
656
<ParameterLocations></ParameterLocations>
657
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
658
<DisplayName>Apache Struts Detection</DisplayName>
659
</AttackModulePolicy>
660
<AttackModulePolicy>
661
<Enabled>1</Enabled>
662
<ModuleId>929E08F60E084936B12C984ED0F5F47C</ModuleId>
663
<ModulePriority>High</ModulePriority>
664
<Severity>High</Severity>
665
<MaxVulnLimit>100</MaxVulnLimit>
666
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
667
<MaxVarianceLimit>4</MaxVarianceLimit>
668
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
669
<EnforceEncoding>0</EnforceEncoding>
670
<ApplyPolicySeverity>0</ApplyPolicySeverity>
671
<AttackPoints>Parameter</AttackPoints>
672
<ParameterLocations>Post</ParameterLocations>
673
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
674
<DisplayName>Arbitrary File Upload</DisplayName>
675
</AttackModulePolicy>
676
<AttackModulePolicy>
677
<Enabled>1</Enabled>
678
<ModuleId>719FF94DEF014D29B16234909941E48E</ModuleId>
679
<ModulePriority>Medium</ModulePriority>
680
<Severity>Low</Severity>
681
<MaxVulnLimit>25</MaxVulnLimit>
682
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
683
<MaxVarianceLimit>2</MaxVarianceLimit>
684
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
685
<EnforceEncoding>0</EnforceEncoding>
686
<ApplyPolicySeverity>0</ApplyPolicySeverity>
687
<AttackPoints>Directory</AttackPoints>
688
<ParameterLocations></ParameterLocations>
689
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
690
<DisplayName>ASP.NET Misconfiguration</DisplayName>
691
</AttackModulePolicy>
692
<AttackModulePolicy>
693
<Enabled>1</Enabled>
694
<ModuleId>B7CEE386C7C64618A510F3F8FED5400B</ModuleId>
695
<ModulePriority>Medium</ModulePriority>
696
<Severity>High</Severity>
697
<MaxVulnLimit>25</MaxVulnLimit>
698
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
699
<MaxVarianceLimit>4</MaxVarianceLimit>
700
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
701
<EnforceEncoding>0</EnforceEncoding>
702
<ApplyPolicySeverity>0</ApplyPolicySeverity>
703
<AttackPoints>Parameter</AttackPoints>
704
<ParameterLocations>Post|Cookie</ParameterLocations>
705
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
706
<DisplayName>ASP.NET Serialization</DisplayName>
707
</AttackModulePolicy>
708
<AttackModulePolicy>
709
<Enabled>1</Enabled>
710
<ModuleId>865E5CE0E5144D3E899B825EC8603969</ModuleId>
711
<ModulePriority>Medium</ModulePriority>
712
<Severity>Low</Severity>
713
<MaxVulnLimit>200</MaxVulnLimit>
714
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
715
<MaxVarianceLimit>2</MaxVarianceLimit>
716
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
717
<EnforceEncoding>0</EnforceEncoding>
718
<ApplyPolicySeverity>0</ApplyPolicySeverity>
719
<AttackPoints>Response Analysis</AttackPoints>
720
<ParameterLocations></ParameterLocations>
721
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
722
<DisplayName>Autocomplete attribute</DisplayName>
723
</AttackModulePolicy>
724
<AttackModulePolicy>
725
<Enabled>1</Enabled>
726
<ModuleId>38354857D10048B68A34CD2E3EBC3B52</ModuleId>
727
<ModulePriority>High</ModulePriority>
728
<Severity>High</Severity>
729
<MaxVulnLimit>75</MaxVulnLimit>
730
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
731
<MaxVarianceLimit>4</MaxVarianceLimit>
732
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
733
<EnforceEncoding>0</EnforceEncoding>
734
<ApplyPolicySeverity>0</ApplyPolicySeverity>
735
<AttackPoints>Parameter</AttackPoints>
736
<ParameterLocations>Query|Post</ParameterLocations>
737
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
738
<DisplayName>Blind LDAP Injection</DisplayName>
739
</AttackModulePolicy>
740
<AttackModulePolicy>
741
<Enabled>1</Enabled>
742
<ModuleId>13B4C758BA174200885A29CBA7346165</ModuleId>
743
<ModulePriority>Medium</ModulePriority>
744
<Severity>Informational</Severity>
745
<MaxVulnLimit>100</MaxVulnLimit>
746
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
747
<MaxVarianceLimit>1</MaxVarianceLimit>
748
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
749
<EnforceEncoding>0</EnforceEncoding>
750
<ApplyPolicySeverity>0</ApplyPolicySeverity>
751
<AttackPoints>Response Analysis</AttackPoints>
752
<ParameterLocations></ParameterLocations>
753
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
754
<DisplayName>Browser Cache directive (web application performance)</DisplayName>
755
</AttackModulePolicy>
756
<AttackModulePolicy>
757
<Enabled>1</Enabled>
758
<ModuleId>E33B272027B844D5BBB8EDE541983474</ModuleId>
759
<ModulePriority>Medium</ModulePriority>
760
<Severity>Low</Severity>
761
<MaxVulnLimit>150</MaxVulnLimit>
762
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
763
<MaxVarianceLimit>4</MaxVarianceLimit>
764
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
765
<EnforceEncoding>0</EnforceEncoding>
766
<ApplyPolicySeverity>0</ApplyPolicySeverity>
767
<AttackPoints>Response Analysis</AttackPoints>
768
<ParameterLocations></ParameterLocations>
769
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
770
<DisplayName>Browser Cache directive (leaking sensitive information)</DisplayName>
771
</AttackModulePolicy>
772
<AttackModulePolicy>
773
<Enabled>1</Enabled>
774
<ModuleId>A8091DB7769C49ED9E844B9F19529AC1</ModuleId>
775
<ModulePriority>High</ModulePriority>
776
<Severity>High</Severity>
777
<MaxVulnLimit>5</MaxVulnLimit>
778
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
779
<MaxVarianceLimit>2</MaxVarianceLimit>
780
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
781
<EnforceEncoding>0</EnforceEncoding>
782
<ApplyPolicySeverity>0</ApplyPolicySeverity>
783
<AttackPoints>Web Resource</AttackPoints>
784
<ParameterLocations></ParameterLocations>
785
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
786
<DisplayName>Brute Force (HTTP Auth)</DisplayName>
787
</AttackModulePolicy>
788
<AttackModulePolicy>
789
<Enabled>1</Enabled>
790
<ModuleId>7F61DDD522C5439B9EAB4FC17B2F47AA</ModuleId>
791
<ModulePriority>High</ModulePriority>
792
<Severity>High</Severity>
793
<MaxVulnLimit>5</MaxVulnLimit>
794
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
795
<MaxVarianceLimit>2</MaxVarianceLimit>
796
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
797
<EnforceEncoding>0</EnforceEncoding>
798
<ApplyPolicySeverity>0</ApplyPolicySeverity>
799
<AttackPoints>Parameter</AttackPoints>
800
<ParameterLocations>Query|Post</ParameterLocations>
801
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
802
<DisplayName>Brute Force (Form Auth)</DisplayName>
803
</AttackModulePolicy>
804
<AttackModulePolicy>
805
<Enabled>1</Enabled>
806
<ModuleId>22E85EEA6883403982D8C298AEBC935A</ModuleId>
807
<ModulePriority>High</ModulePriority>
808
<Severity>High</Severity>
809
<MaxVulnLimit>250</MaxVulnLimit>
810
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
811
<MaxVarianceLimit>4</MaxVarianceLimit>
812
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
813
<EnforceEncoding>0</EnforceEncoding>
814
<ApplyPolicySeverity>0</ApplyPolicySeverity>
815
<AttackPoints>Parameter</AttackPoints>
816
<ParameterLocations>Directory|File|Path|Query|Post|Cookie|Referer|Http Header</ParameterLocations>
817
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
818
<DisplayName>Blind SQL</DisplayName>
819
</AttackModulePolicy>
820
<AttackModulePolicy>
821
<Enabled>1</Enabled>
822
<ModuleId>FD1C760270CE493D92F50C347C79218F</ModuleId>
823
<ModulePriority>Low</ModulePriority>
824
<Severity>Low</Severity>
825
<MaxVulnLimit>100</MaxVulnLimit>
826
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
827
<MaxVarianceLimit>4</MaxVarianceLimit>
828
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
829
<EnforceEncoding>0</EnforceEncoding>
830
<ApplyPolicySeverity>0</ApplyPolicySeverity>
831
<AttackPoints>Directory</AttackPoints>
832
<ParameterLocations></ParameterLocations>
833
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
834
<DisplayName>Clients Cross-Domain Policy Files</DisplayName>
835
</AttackModulePolicy>
836
<AttackModulePolicy>
837
<Enabled>1</Enabled>
838
<ModuleId>A41D5AC842594BF086E9A96DD3353333</ModuleId>
839
<ModulePriority>Low</ModulePriority>
840
<Severity>Informational</Severity>
841
<MaxVulnLimit>100</MaxVulnLimit>
842
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
843
<MaxVarianceLimit>4</MaxVarianceLimit>
844
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
845
<EnforceEncoding>0</EnforceEncoding>
846
<ApplyPolicySeverity>0</ApplyPolicySeverity>
847
<AttackPoints>Response Analysis</AttackPoints>
848
<ParameterLocations></ParameterLocations>
849
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
850
<DisplayName>Information Disclosure in comments</DisplayName>
851
</AttackModulePolicy>
852
<AttackModulePolicy>
853
<Enabled>1</Enabled>
854
<ModuleId>BBFCB66779ED4E7292C08F19E9BB45DF</ModuleId>
855
<ModulePriority>Medium</ModulePriority>
856
<Severity>Low</Severity>
857
<MaxVulnLimit>50</MaxVulnLimit>
858
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
859
<MaxVarianceLimit>10</MaxVarianceLimit>
860
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
861
<EnforceEncoding>0</EnforceEncoding>
862
<ApplyPolicySeverity>0</ApplyPolicySeverity>
863
<AttackPoints>Response Analysis</AttackPoints>
864
<ParameterLocations></ParameterLocations>
865
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
866
<DisplayName>Cookie attributes</DisplayName>
867
</AttackModulePolicy>
868
<AttackModulePolicy>
869
<Enabled>1</Enabled>
870
<ModuleId>2227AE47A2AA40A6B6B1328AC13A6F0C</ModuleId>
871
<ModulePriority>Low</ModulePriority>
872
<Severity>Low</Severity>
873
<MaxVulnLimit>100</MaxVulnLimit>
874
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
875
<MaxVarianceLimit>5</MaxVarianceLimit>
876
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
877
<EnforceEncoding>0</EnforceEncoding>
878
<ApplyPolicySeverity>0</ApplyPolicySeverity>
879
<AttackPoints>Web Resource|Response Analysis</AttackPoints>
880
<ParameterLocations></ParameterLocations>
881
<RequestOriginations>AJAX</RequestOriginations>
882
<DisplayName>Cross Origin Resources Sharing (CORS)</DisplayName>
883
</AttackModulePolicy>
884
<AttackModulePolicy>
885
<Enabled>1</Enabled>
886
<ModuleId>F8A0814584594965B0AF68B4E190F566</ModuleId>
887
<ModulePriority>Low</ModulePriority>
888
<Severity>Medium</Severity>
889
<MaxVulnLimit>25</MaxVulnLimit>
890
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
891
<MaxVarianceLimit>2</MaxVarianceLimit>
892
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
893
<EnforceEncoding>0</EnforceEncoding>
894
<ApplyPolicySeverity>0</ApplyPolicySeverity>
895
<AttackPoints>Response Analysis</AttackPoints>
896
<ParameterLocations></ParameterLocations>
897
<RequestOriginations>HTML|Form|Silverlight</RequestOriginations>
898
<DisplayName>Credentials over an insecure channel</DisplayName>
899
</AttackModulePolicy>
900
<AttackModulePolicy>
901
<Enabled>1</Enabled>
902
<ModuleId>C35E7D79DD6F4DA489BBF6BC1D9D012B</ModuleId>
903
<ModulePriority>Medium</ModulePriority>
904
<Severity>Informational</Severity>
905
<MaxVulnLimit>100</MaxVulnLimit>
906
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
907
<MaxVarianceLimit>4</MaxVarianceLimit>
908
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
909
<EnforceEncoding>0</EnforceEncoding>
910
<ApplyPolicySeverity>0</ApplyPolicySeverity>
911
<AttackPoints>Response Analysis</AttackPoints>
912
<ParameterLocations></ParameterLocations>
913
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
914
<DisplayName>Content Security Policy Header</DisplayName>
915
</AttackModulePolicy>
916
<AttackModulePolicy>
917
<Enabled>1</Enabled>
918
<ModuleId>81C9D7ED0E33447899D5CD20B978617B</ModuleId>
919
<ModulePriority>Low</ModulePriority>
920
<Severity>Low</Severity>
921
<MaxVulnLimit>250</MaxVulnLimit>
922
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
923
<MaxVarianceLimit>2</MaxVarianceLimit>
924
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
925
<EnforceEncoding>0</EnforceEncoding>
926
<ApplyPolicySeverity>0</ApplyPolicySeverity>
927
<AttackPoints>Web Resource</AttackPoints>
928
<ParameterLocations></ParameterLocations>
929
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
930
<DisplayName>Cross-Site Request Forgery (CSRF)</DisplayName>
931
</AttackModulePolicy>
932
<AttackModulePolicy>
933
<Enabled>0</Enabled>
934
<ModuleId>3A586D24C653446196BAAC345FDE8C53</ModuleId>
935
<ModulePriority>Medium</ModulePriority>
936
<Severity>Informational</Severity>
937
<MaxVulnLimit>20</MaxVulnLimit>
938
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
939
<MaxVarianceLimit>1</MaxVarianceLimit>
940
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
941
<EnforceEncoding>0</EnforceEncoding>
942
<ApplyPolicySeverity>0</ApplyPolicySeverity>
943
<AttackPoints>Directory</AttackPoints>
944
<ParameterLocations></ParameterLocations>
945
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
946
<DisplayName>Custom Directory Module</DisplayName>
947
</AttackModulePolicy>
948
<AttackModulePolicy>
949
<Enabled>0</Enabled>
950
<ModuleId>EE998B281CE840948E90BF2D61E4C5F9</ModuleId>
951
<ModulePriority>Medium</ModulePriority>
952
<Severity>Informational</Severity>
953
<MaxVulnLimit>20</MaxVulnLimit>
954
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
955
<MaxVarianceLimit>1</MaxVarianceLimit>
956
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
957
<EnforceEncoding>0</EnforceEncoding>
958
<ApplyPolicySeverity>0</ApplyPolicySeverity>
959
<AttackPoints>Parameter</AttackPoints>
960
<ParameterLocations>Directory|File|Path|Query|Fragment|Post|Cookie|Referer|Http Header</ParameterLocations>
961
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
962
<DisplayName>Custom Parameter Module</DisplayName>
963
</AttackModulePolicy>
964
<AttackModulePolicy>
965
<Enabled>0</Enabled>
966
<ModuleId>1DE8C004C53D4B89A41E6B98DC6FD3B4</ModuleId>
967
<ModulePriority>Medium</ModulePriority>
968
<Severity>Informational</Severity>
969
<MaxVulnLimit>20</MaxVulnLimit>
970
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
971
<MaxVarianceLimit>1</MaxVarianceLimit>
972
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
973
<EnforceEncoding>0</EnforceEncoding>
974
<ApplyPolicySeverity>0</ApplyPolicySeverity>
975
<AttackPoints>Response Analysis</AttackPoints>
976
<ParameterLocations></ParameterLocations>
977
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
978
<DisplayName>Custom Passive Module</DisplayName>
979
</AttackModulePolicy>
980
<AttackModulePolicy>
981
<Enabled>1</Enabled>
982
<ModuleId>2CE90A403F704F80961E381BE19CCA2F</ModuleId>
983
<ModulePriority>Medium</ModulePriority>
984
<Severity>Low</Severity>
985
<MaxVulnLimit>250</MaxVulnLimit>
986
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
987
<MaxVarianceLimit>1</MaxVarianceLimit>
988
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
989
<EnforceEncoding>0</EnforceEncoding>
990
<ApplyPolicySeverity>0</ApplyPolicySeverity>
991
<AttackPoints>Directory</AttackPoints>
992
<ParameterLocations></ParameterLocations>
993
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
994
<DisplayName>Directory Indexing</DisplayName>
995
</AttackModulePolicy>
996
<AttackModulePolicy>
997
<Enabled>1</Enabled>
998
<ModuleId>240EBB4A72024BA585833EB1F1AB4EC0</ModuleId>
999
<ModulePriority>Low</ModulePriority>
1000
<Severity>Informational</Severity>
1001
<MaxVulnLimit>150</MaxVulnLimit>
1002
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1003
<MaxVarianceLimit>4</MaxVarianceLimit>
1004
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1005
<EnforceEncoding>0</EnforceEncoding>
1006
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1007
<AttackPoints>Response Analysis</AttackPoints>
1008
<ParameterLocations></ParameterLocations>
1009
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
1010
<DisplayName>Email Disclosure</DisplayName>
1011
</AttackModulePolicy>
1012
<AttackModulePolicy>
1013
<Enabled>1</Enabled>
1014
<ModuleId>9B62D146FF00456388F9822A76F95841</ModuleId>
1015
<ModulePriority>High</ModulePriority>
1016
<Severity>High</Severity>
1017
<MaxVulnLimit>100</MaxVulnLimit>
1018
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1019
<MaxVarianceLimit>4</MaxVarianceLimit>
1020
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1021
<EnforceEncoding>0</EnforceEncoding>
1022
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1023
<AttackPoints>Parameter</AttackPoints>
1024
<ParameterLocations>Path|Query|Post</ParameterLocations>
1025
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1026
<DisplayName>Expression Language Injection</DisplayName>
1027
</AttackModulePolicy>
1028
<AttackModulePolicy>
1029
<Enabled>1</Enabled>
1030
<ModuleId>D07D5C8EF8664392A0CC1509A6DE5940</ModuleId>
1031
<ModulePriority>Low</ModulePriority>
1032
<Severity>Low</Severity>
1033
<MaxVulnLimit>100</MaxVulnLimit>
1034
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1035
<MaxVarianceLimit>2</MaxVarianceLimit>
1036
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1037
<EnforceEncoding>0</EnforceEncoding>
1038
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1039
<AttackPoints>Parameter</AttackPoints>
1040
<ParameterLocations>Directory|Path|Query|Post|Cookie</ParameterLocations>
1041
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1042
<DisplayName>Forced Browsing</DisplayName>
1043
</AttackModulePolicy>
1044
<AttackModulePolicy>
1045
<Enabled>1</Enabled>
1046
<ModuleId>FD28B5D41E064D37B5543CE22BBC6306</ModuleId>
1047
<ModulePriority>Medium</ModulePriority>
1048
<Severity>Low</Severity>
1049
<MaxVulnLimit>200</MaxVulnLimit>
1050
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1051
<MaxVarianceLimit>2</MaxVarianceLimit>
1052
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1053
<EnforceEncoding>0</EnforceEncoding>
1054
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1055
<AttackPoints>Response Analysis</AttackPoints>
1056
<ParameterLocations></ParameterLocations>
1057
<RequestOriginations>HTML|Form|Silverlight</RequestOriginations>
1058
<DisplayName>Sensitive Data Exposure</DisplayName>
1059
</AttackModulePolicy>
1060
<AttackModulePolicy>
1061
<Enabled>1</Enabled>
1062
<ModuleId>7B61BD81D278490C9B1A7B0568E94E30</ModuleId>
1063
<ModulePriority>High</ModulePriority>
1064
<Severity>Low</Severity>
1065
<MaxVulnLimit>5</MaxVulnLimit>
1066
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1067
<MaxVarianceLimit>4</MaxVarianceLimit>
1068
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1069
<EnforceEncoding>0</EnforceEncoding>
1070
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1071
<AttackPoints>Web Resource</AttackPoints>
1072
<ParameterLocations></ParameterLocations>
1073
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
1074
<DisplayName>Form Session Strength</DisplayName>
1075
</AttackModulePolicy>
1076
<AttackModulePolicy>
1077
<Enabled>1</Enabled>
1078
<ModuleId>5032DAF0D8FE4294B23F0D1DAA4C0337</ModuleId>
1079
<ModulePriority>High</ModulePriority>
1080
<Severity>High</Severity>
1081
<MaxVulnLimit>25</MaxVulnLimit>
1082
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1083
<MaxVarianceLimit>50</MaxVarianceLimit>
1084
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1085
<EnforceEncoding>0</EnforceEncoding>
1086
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1087
<AttackPoints>Web Site</AttackPoints>
1088
<ParameterLocations></ParameterLocations>
1089
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
1090
<DisplayName>FrontPage Checks</DisplayName>
1091
</AttackModulePolicy>
1092
<AttackModulePolicy>
1093
<Enabled>1</Enabled>
1094
<ModuleId>748E90FC47AB4B438C3A49660989B44A</ModuleId>
1095
<ModulePriority>High</ModulePriority>
1096
<Severity>High</Severity>
1097
<MaxVulnLimit>25</MaxVulnLimit>
1098
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1099
<MaxVarianceLimit>1</MaxVarianceLimit>
1100
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1101
<EnforceEncoding>0</EnforceEncoding>
1102
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1103
<AttackPoints>Web Site</AttackPoints>
1104
<ParameterLocations></ParameterLocations>
1105
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1106
<DisplayName>Heartbleed Check</DisplayName>
1107
</AttackModulePolicy>
1108
<AttackModulePolicy>
1109
<Enabled>1</Enabled>
1110
<ModuleId>EBEE6CA2515F4FBEB8B7EC0197C5A74F</ModuleId>
1111
<ModulePriority>Low</ModulePriority>
1112
<Severity>Informational</Severity>
1113
<MaxVulnLimit>20</MaxVulnLimit>
1114
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1115
<MaxVarianceLimit>1</MaxVarianceLimit>
1116
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1117
<EnforceEncoding>0</EnforceEncoding>
1118
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1119
<AttackPoints>Response Analysis</AttackPoints>
1120
<ParameterLocations></ParameterLocations>
1121
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1122
<DisplayName>HTTP Strict Transport Security</DisplayName>
1123
</AttackModulePolicy>
1124
<AttackModulePolicy>
1125
<Enabled>1</Enabled>
1126
<ModuleId>F25AF6387E8A429F8E664F31E2974054</ModuleId>
1127
<ModulePriority>Low</ModulePriority>
1128
<Severity>Low</Severity>
1129
<MaxVulnLimit>20</MaxVulnLimit>
1130
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1131
<MaxVarianceLimit>4</MaxVarianceLimit>
1132
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1133
<EnforceEncoding>0</EnforceEncoding>
1134
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1135
<AttackPoints>Response Analysis</AttackPoints>
1136
<ParameterLocations></ParameterLocations>
1137
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1138
<DisplayName>HTTP Authentication over insecure channel</DisplayName>
1139
</AttackModulePolicy>
1140
<AttackModulePolicy>
1141
<Enabled>1</Enabled>
1142
<ModuleId>60B0D57597EF4542A15FCB8D907669B0</ModuleId>
1143
<ModulePriority>Low</ModulePriority>
1144
<Severity>Low</Severity>
1145
<MaxVulnLimit>200</MaxVulnLimit>
1146
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1147
<MaxVarianceLimit>1</MaxVarianceLimit>
1148
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1149
<EnforceEncoding>0</EnforceEncoding>
1150
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1151
<AttackPoints>Web Resource</AttackPoints>
1152
<ParameterLocations></ParameterLocations>
1153
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1154
<DisplayName>HTTPS Downgrade</DisplayName>
1155
</AttackModulePolicy>
1156
<AttackModulePolicy>
1157
<Enabled>1</Enabled>
1158
<ModuleId>55D76EB20CE54C01856E43223232E3DD</ModuleId>
1159
<ModulePriority>Medium</ModulePriority>
1160
<Severity>Informational</Severity>
1161
<MaxVulnLimit>200</MaxVulnLimit>
1162
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1163
<MaxVarianceLimit>4</MaxVarianceLimit>
1164
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1165
<EnforceEncoding>0</EnforceEncoding>
1166
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1167
<AttackPoints>Response Analysis</AttackPoints>
1168
<ParameterLocations></ParameterLocations>
1169
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1170
<DisplayName>HTTP Headers</DisplayName>
1171
</AttackModulePolicy>
1172
<AttackModulePolicy>
1173
<Enabled>1</Enabled>
1174
<ModuleId>DE08B6DDD872440E91347969D514CFD6</ModuleId>
1175
<ModulePriority>High</ModulePriority>
1176
<Severity>High</Severity>
1177
<MaxVulnLimit>200</MaxVulnLimit>
1178
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1179
<MaxVarianceLimit>4</MaxVarianceLimit>
1180
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1181
<EnforceEncoding>0</EnforceEncoding>
1182
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1183
<AttackPoints>Parameter</AttackPoints>
1184
<ParameterLocations>Directory|File|Path|Query|Fragment|Post|Cookie|Referer|Http Header</ParameterLocations>
1185
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1186
<DisplayName>HTTP Response Splitting</DisplayName>
1187
</AttackModulePolicy>
1188
<AttackModulePolicy>
1189
<Enabled>1</Enabled>
1190
<ModuleId>1712CD453B074C78A8A561E0ED66DD1F</ModuleId>
1191
<ModulePriority>Low</ModulePriority>
1192
<Severity>Low</Severity>
1193
<MaxVulnLimit>200</MaxVulnLimit>
1194
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1195
<MaxVarianceLimit>1</MaxVarianceLimit>
1196
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1197
<EnforceEncoding>0</EnforceEncoding>
1198
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1199
<AttackPoints>Web Site|Web Resource|Response Analysis</AttackPoints>
1200
<ParameterLocations></ParameterLocations>
1201
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1202
<DisplayName>HTTPS Everywhere</DisplayName>
1203
</AttackModulePolicy>
1204
<AttackModulePolicy>
1205
<Enabled>1</Enabled>
1206
<ModuleId>881B35A841414BBAA05084A2A8CE7904</ModuleId>
1207
<ModulePriority>Low</ModulePriority>
1208
<Severity>Informational</Severity>
1209
<MaxVulnLimit>20</MaxVulnLimit>
1210
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1211
<MaxVarianceLimit>1</MaxVarianceLimit>
1212
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1213
<EnforceEncoding>0</EnforceEncoding>
1214
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1215
<AttackPoints>Web Resource</AttackPoints>
1216
<ParameterLocations></ParameterLocations>
1217
<RequestOriginations>HTML|Form|Flash|Silverlight</RequestOriginations>
1218
<DisplayName>HTTP User-Agent Check</DisplayName>
1219
</AttackModulePolicy>
1220
<AttackModulePolicy>
1221
<Enabled>1</Enabled>
1222
<ModuleId>6A609D0096124619842EE23FA7C989B5</ModuleId>
1223
<ModulePriority>Low</ModulePriority>
1224
<Severity>Informational</Severity>
1225
<MaxVulnLimit>500</MaxVulnLimit>
1226
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1227
<MaxVarianceLimit>4</MaxVarianceLimit>
1228
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1229
<EnforceEncoding>0</EnforceEncoding>
1230
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1231
<AttackPoints>Response Analysis</AttackPoints>
1232
<ParameterLocations></ParameterLocations>
1233
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1234
<DisplayName>Information Disclosure in response</DisplayName>
1235
</AttackModulePolicy>
1236
<AttackModulePolicy>
1237
<Enabled>1</Enabled>
1238
<ModuleId>E617D008F7534C808064D2B1A4BFE81A</ModuleId>
1239
<ModulePriority>High</ModulePriority>
1240
<Severity>Low</Severity>
1241
<MaxVulnLimit>500</MaxVulnLimit>
1242
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1243
<MaxVarianceLimit>4</MaxVarianceLimit>
1244
<PassiveAnalysisOnAttacks>1</PassiveAnalysisOnAttacks>
1245
<EnforceEncoding>0</EnforceEncoding>
1246
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1247
<AttackPoints>Response Analysis</AttackPoints>
1248
<ParameterLocations></ParameterLocations>
1249
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1250
<DisplayName>Information Leakage in responses</DisplayName>
1251
</AttackModulePolicy>
1252
<AttackModulePolicy>
1253
<Enabled>1</Enabled>
1254
<ModuleId>B86A3A67D710456898A9009DBF6A4989</ModuleId>
1255
<ModulePriority>Low</ModulePriority>
1256
<Severity>Low</Severity>
1257
<MaxVulnLimit>100</MaxVulnLimit>
1258
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1259
<MaxVarianceLimit>4</MaxVarianceLimit>
1260
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1261
<EnforceEncoding>0</EnforceEncoding>
1262
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1263
<AttackPoints>Web Resource</AttackPoints>
1264
<ParameterLocations></ParameterLocations>
1265
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
1266
<DisplayName>Java Grinder</DisplayName>
1267
</AttackModulePolicy>
1268
<AttackModulePolicy>
1269
<Enabled>1</Enabled>
1270
<ModuleId>F10ACEB0A6804D0F93516428E64B46FD</ModuleId>
1271
<ModulePriority>Low</ModulePriority>
1272
<Severity>Informational</Severity>
1273
<MaxVulnLimit>100</MaxVulnLimit>
1274
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1275
<MaxVarianceLimit>4</MaxVarianceLimit>
1276
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1277
<EnforceEncoding>0</EnforceEncoding>
1278
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1279
<AttackPoints>Response Analysis</AttackPoints>
1280
<ParameterLocations></ParameterLocations>
1281
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight</RequestOriginations>
1282
<DisplayName>JavaScript Memory Leaks</DisplayName>
1283
</AttackModulePolicy>
1284
<AttackModulePolicy>
1285
<Enabled>1</Enabled>
1286
<ModuleId>B7FD0D454CB246AC85A29AF53C27157F</ModuleId>
1287
<ModulePriority>High</ModulePriority>
1288
<Severity>High</Severity>
1289
<MaxVulnLimit>100</MaxVulnLimit>
1290
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1291
<MaxVarianceLimit>4</MaxVarianceLimit>
1292
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1293
<EnforceEncoding>0</EnforceEncoding>
1294
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1295
<AttackPoints>Parameter</AttackPoints>
1296
<ParameterLocations>Path|Query|Post|Cookie</ParameterLocations>
1297
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1298
<DisplayName>LDAP Injection</DisplayName>
1299
</AttackModulePolicy>
1300
<AttackModulePolicy>
1301
<Enabled>1</Enabled>
1302
<ModuleId>FCD9A41AD39247C0B45A8D42FF7A4E5E</ModuleId>
1303
<ModulePriority>High</ModulePriority>
1304
<Severity>Informational</Severity>
1305
<MaxVulnLimit>250</MaxVulnLimit>
1306
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1307
<MaxVarianceLimit>4</MaxVarianceLimit>
1308
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1309
<EnforceEncoding>0</EnforceEncoding>
1310
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1311
<AttackPoints>Response Analysis</AttackPoints>
1312
<ParameterLocations></ParameterLocations>
1313
<RequestOriginations>HTML|Form|AJAX</RequestOriginations>
1314
<DisplayName>Local Storage Usage</DisplayName>
1315
</AttackModulePolicy>
1316
<AttackModulePolicy>
1317
<Enabled>1</Enabled>
1318
<ModuleId>466E4CC294D94A11AFD50FD01D56261F</ModuleId>
1319
<ModulePriority>Medium</ModulePriority>
1320
<Severity>Low</Severity>
1321
<MaxVulnLimit>100</MaxVulnLimit>
1322
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1323
<MaxVarianceLimit>4</MaxVarianceLimit>
1324
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1325
<EnforceEncoding>0</EnforceEncoding>
1326
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1327
<AttackPoints>Parameter|Response Analysis</AttackPoints>
1328
<ParameterLocations>Path|Query|Post|Cookie|Referer</ParameterLocations>
1329
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1330
<DisplayName>Business logic abuse attacks</DisplayName>
1331
</AttackModulePolicy>
1332
<AttackModulePolicy>
1333
<Enabled>1</Enabled>
1334
<ModuleId>7D06B46D915644E9870F4A6B903FC09F</ModuleId>
1335
<ModulePriority>High</ModulePriority>
1336
<Severity>High</Severity>
1337
<MaxVulnLimit>10</MaxVulnLimit>
1338
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1339
<MaxVarianceLimit>1</MaxVarianceLimit>
1340
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1341
<EnforceEncoding>0</EnforceEncoding>
1342
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1343
<AttackPoints>Parameter</AttackPoints>
1344
<ParameterLocations>Path|Query|Post|Cookie|Referer</ParameterLocations>
1345
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1346
<DisplayName>Nginx NULL code</DisplayName>
1347
</AttackModulePolicy>
1348
<AttackModulePolicy>
1349
<Enabled>1</Enabled>
1350
<ModuleId>99E5E4DD1B734047B95402FB7C76BEC3</ModuleId>
1351
<ModulePriority>Medium</ModulePriority>
1352
<Severity>High</Severity>
1353
<MaxVulnLimit>200</MaxVulnLimit>
1354
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1355
<MaxVarianceLimit>4</MaxVarianceLimit>
1356
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1357
<EnforceEncoding>0</EnforceEncoding>
1358
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1359
<AttackPoints>Parameter</AttackPoints>
1360
<ParameterLocations>File|Path|Query|Post</ParameterLocations>
1361
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1362
<DisplayName>OS Commanding</DisplayName>
1363
</AttackModulePolicy>
1364
<AttackModulePolicy>
1365
<Enabled>1</Enabled>
1366
<ModuleId>2934BC76771C4016BD3524B432CEBCA8</ModuleId>
1367
<ModulePriority>High</ModulePriority>
1368
<Severity>High</Severity>
1369
<MaxVulnLimit>250</MaxVulnLimit>
1370
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1371
<MaxVarianceLimit>5</MaxVarianceLimit>
1372
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1373
<EnforceEncoding>0</EnforceEncoding>
1374
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1375
<AttackPoints>Parameter</AttackPoints>
1376
<ParameterLocations>Query|Post</ParameterLocations>
1377
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1378
<DisplayName>Out of Band Stored Cross-site scripting (XSS)</DisplayName>
1379
</AttackModulePolicy>
1380
<AttackModulePolicy>
1381
<Enabled>1</Enabled>
1382
<ModuleId>A62D1481CB394632B06C0C54FCDD0579</ModuleId>
1383
<ModulePriority>High</ModulePriority>
1384
<Severity>Medium</Severity>
1385
<MaxVulnLimit>250</MaxVulnLimit>
1386
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1387
<MaxVarianceLimit>5</MaxVarianceLimit>
1388
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1389
<EnforceEncoding>0</EnforceEncoding>
1390
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1391
<AttackPoints>Parameter</AttackPoints>
1392
<ParameterLocations>Query|Post</ParameterLocations>
1393
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1394
<DisplayName>Out of Band Cross-site scripting (XSS)</DisplayName>
1395
</AttackModulePolicy>
1396
<AttackModulePolicy>
1397
<Enabled>1</Enabled>
1398
<ModuleId>A8AB603EABC04875A5B2320CF6990C24</ModuleId>
1399
<ModulePriority>High</ModulePriority>
1400
<Severity>Medium</Severity>
1401
<MaxVulnLimit>500</MaxVulnLimit>
1402
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1403
<MaxVarianceLimit>4</MaxVarianceLimit>
1404
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1405
<EnforceEncoding>0</EnforceEncoding>
1406
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1407
<AttackPoints>Parameter</AttackPoints>
1408
<ParameterLocations>Path|Query|Post|Cookie|Referer</ParameterLocations>
1409
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1410
<DisplayName>Parameter Fuzzing</DisplayName>
1411
</AttackModulePolicy>
1412
<AttackModulePolicy>
1413
<Enabled>1</Enabled>
1414
<ModuleId>FAC53175FF1E4478AA6D3E2DD4D66B6D</ModuleId>
1415
<ModulePriority>High</ModulePriority>
1416
<Severity>Low</Severity>
1417
<MaxVulnLimit>10</MaxVulnLimit>
1418
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1419
<MaxVarianceLimit>2</MaxVarianceLimit>
1420
<PassiveAnalysisOnAttacks>1</PassiveAnalysisOnAttacks>
1421
<EnforceEncoding>0</EnforceEncoding>
1422
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1423
<AttackPoints>Response Analysis</AttackPoints>
1424
<ParameterLocations></ParameterLocations>
1425
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1426
<DisplayName>Credentials stored in clear text in a cookie.</DisplayName>
1427
</AttackModulePolicy>
1428
<AttackModulePolicy>
1429
<Enabled>1</Enabled>
1430
<ModuleId>243C315A46A14C92A2717A29A4290167</ModuleId>
1431
<ModulePriority>Medium</ModulePriority>
1432
<Severity>Informational</Severity>
1433
<MaxVulnLimit>200</MaxVulnLimit>
1434
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1435
<MaxVarianceLimit>10</MaxVarianceLimit>
1436
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1437
<EnforceEncoding>0</EnforceEncoding>
1438
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1439
<AttackPoints>Response Analysis</AttackPoints>
1440
<ParameterLocations></ParameterLocations>
1441
<RequestOriginations>HTML|Form|Silverlight</RequestOriginations>
1442
<DisplayName>Collecting Sensitive Personal Information</DisplayName>
1443
</AttackModulePolicy>
1444
<AttackModulePolicy>
1445
<Enabled>1</Enabled>
1446
<ModuleId>B97A29683AEE4AA2B94FC26BFC2694A9</ModuleId>
1447
<ModulePriority>High</ModulePriority>
1448
<Severity>Medium</Severity>
1449
<MaxVulnLimit>100</MaxVulnLimit>
1450
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1451
<MaxVarianceLimit>4</MaxVarianceLimit>
1452
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1453
<EnforceEncoding>0</EnforceEncoding>
1454
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1455
<AttackPoints>Parameter</AttackPoints>
1456
<ParameterLocations>Query|Post|Cookie</ParameterLocations>
1457
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1458
<DisplayName>PHP Code Execution</DisplayName>
1459
</AttackModulePolicy>
1460
<AttackModulePolicy>
1461
<Enabled>1</Enabled>
1462
<ModuleId>FF01402DB70848D88ACB0736B6E4BCF5</ModuleId>
1463
<ModulePriority>High</ModulePriority>
1464
<Severity>Low</Severity>
1465
<MaxVulnLimit>4</MaxVulnLimit>
1466
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1467
<MaxVarianceLimit>4</MaxVarianceLimit>
1468
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1469
<EnforceEncoding>0</EnforceEncoding>
1470
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1471
<AttackPoints>Web Resource</AttackPoints>
1472
<ParameterLocations></ParameterLocations>
1473
<RequestOriginations>HTML</RequestOriginations>
1474
<DisplayName>Privacy Policy Check</DisplayName>
1475
</AttackModulePolicy>
1476
<AttackModulePolicy>
1477
<Enabled>1</Enabled>
1478
<ModuleId>AFF041E38E444889B271CDE1B24378EA</ModuleId>
1479
<ModulePriority>Low</ModulePriority>
1480
<Severity>Informational</Severity>
1481
<MaxVulnLimit>250</MaxVulnLimit>
1482
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1483
<MaxVarianceLimit>10</MaxVarianceLimit>
1484
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1485
<EnforceEncoding>0</EnforceEncoding>
1486
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1487
<AttackPoints>Response Analysis</AttackPoints>
1488
<ParameterLocations></ParameterLocations>
1489
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1490
<DisplayName>Privacy Disclosure</DisplayName>
1491
</AttackModulePolicy>
1492
<AttackModulePolicy>
1493
<Enabled>1</Enabled>
1494
<ModuleId>433C43A54C714F08B822B7932D410A78</ModuleId>
1495
<ModulePriority>Medium</ModulePriority>
1496
<Severity>Low</Severity>
1497
<MaxVulnLimit>10</MaxVulnLimit>
1498
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1499
<MaxVarianceLimit>4</MaxVarianceLimit>
1500
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1501
<EnforceEncoding>0</EnforceEncoding>
1502
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1503
<AttackPoints>Web Resource|Response Analysis</AttackPoints>
1504
<ParameterLocations></ParameterLocations>
1505
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1506
<DisplayName>Privilege Escalation</DisplayName>
1507
</AttackModulePolicy>
1508
<AttackModulePolicy>
1509
<Enabled>1</Enabled>
1510
<ModuleId>ED2E98EFF9A14BF7ACA06A7B28FF97BE</ModuleId>
1511
<ModulePriority>Low</ModulePriority>
1512
<Severity>Informational</Severity>
1513
<MaxVulnLimit>200</MaxVulnLimit>
1514
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1515
<MaxVarianceLimit>4</MaxVarianceLimit>
1516
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1517
<EnforceEncoding>0</EnforceEncoding>
1518
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1519
<AttackPoints>Response Analysis</AttackPoints>
1520
<ParameterLocations></ParameterLocations>
1521
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1522
<DisplayName>Profanity</DisplayName>
1523
</AttackModulePolicy>
1524
<AttackModulePolicy>
1525
<Enabled>1</Enabled>
1526
<ModuleId>0AE25E41D6F44F29900104EF86B04191</ModuleId>
1527
<ModulePriority>Low</ModulePriority>
1528
<Severity>Safe</Severity>
1529
<MaxVulnLimit>500</MaxVulnLimit>
1530
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1531
<MaxVarianceLimit>4</MaxVarianceLimit>
1532
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1533
<EnforceEncoding>0</EnforceEncoding>
1534
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1535
<AttackPoints>Parameter</AttackPoints>
1536
<ParameterLocations>Directory|File|Path|Query|Post|Cookie</ParameterLocations>
1537
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
1538
<DisplayName>Reflection</DisplayName>
1539
</AttackModulePolicy>
1540
<AttackModulePolicy>
1541
<Enabled>1</Enabled>
1542
<ModuleId>8CB2F93CE7F243B98D3C83A9A3E6EA4B</ModuleId>
1543
<ModulePriority>Medium</ModulePriority>
1544
<Severity>Medium</Severity>
1545
<MaxVulnLimit>1000</MaxVulnLimit>
1546
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1547
<MaxVarianceLimit>4</MaxVarianceLimit>
1548
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1549
<EnforceEncoding>0</EnforceEncoding>
1550
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1551
<AttackPoints>Directory|File|Parameter</AttackPoints>
1552
<ParameterLocations>Query|Post|Cookie</ParameterLocations>
1553
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1554
<DisplayName>File Inclusion</DisplayName>
1555
</AttackModulePolicy>
1556
<AttackModulePolicy>
1557
<Enabled>1</Enabled>
1558
<ModuleId>63430695B68941DF99BF242F5AE1674B</ModuleId>
1559
<ModulePriority>Low</ModulePriority>
1560
<Severity>Informational</Severity>
1561
<MaxVulnLimit>50</MaxVulnLimit>
1562
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1563
<MaxVarianceLimit>2</MaxVarianceLimit>
1564
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1565
<EnforceEncoding>0</EnforceEncoding>
1566
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1567
<AttackPoints>Web Resource</AttackPoints>
1568
<ParameterLocations></ParameterLocations>
1569
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1570
<DisplayName>HTTP Verb Tampering</DisplayName>
1571
</AttackModulePolicy>
1572
<AttackModulePolicy>
1573
<Enabled>1</Enabled>
1574
<ModuleId>D8741C7560B8431A9AE74E9B4FEB4F45</ModuleId>
1575
<ModulePriority>Low</ModulePriority>
1576
<Severity>Low</Severity>
1577
<MaxVulnLimit>200</MaxVulnLimit>
1578
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1579
<MaxVarianceLimit>10</MaxVarianceLimit>
1580
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1581
<EnforceEncoding>0</EnforceEncoding>
1582
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1583
<AttackPoints>Web Site|Directory|File</AttackPoints>
1584
<ParameterLocations></ParameterLocations>
1585
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1586
<DisplayName>Predictable Resource Location</DisplayName>
1587
</AttackModulePolicy>
1588
<AttackModulePolicy>
1589
<Enabled>1</Enabled>
1590
<ModuleId>13623AA162FA4488852116B7EC0DE49E</ModuleId>
1591
<ModulePriority>Medium</ModulePriority>
1592
<Severity>Medium</Severity>
1593
<MaxVulnLimit>250</MaxVulnLimit>
1594
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1595
<MaxVarianceLimit>4</MaxVarianceLimit>
1596
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1597
<EnforceEncoding>0</EnforceEncoding>
1598
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1599
<AttackPoints>Parameter</AttackPoints>
1600
<ParameterLocations>Query</ParameterLocations>
1601
<RequestOriginations>HTML|Form</RequestOriginations>
1602
<DisplayName>Reverse Clickjacking</DisplayName>
1603
</AttackModulePolicy>
1604
<AttackModulePolicy>
1605
<Enabled>1</Enabled>
1606
<ModuleId>A418163442A54BB9BB0F1E591881A835</ModuleId>
1607
<ModulePriority>High</ModulePriority>
1608
<Severity>Low</Severity>
1609
<MaxVulnLimit>25</MaxVulnLimit>
1610
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1611
<MaxVarianceLimit>1</MaxVarianceLimit>
1612
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1613
<EnforceEncoding>0</EnforceEncoding>
1614
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1615
<AttackPoints>Web Site</AttackPoints>
1616
<ParameterLocations></ParameterLocations>
1617
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1618
<DisplayName>Reverse Proxy</DisplayName>
1619
</AttackModulePolicy>
1620
<AttackModulePolicy>
1621
<Enabled>1</Enabled>
1622
<ModuleId>2C7D393BABA44517B0A37DC8ADCF9630</ModuleId>
1623
<ModulePriority>Low</ModulePriority>
1624
<Severity>Low</Severity>
1625
<MaxVulnLimit>200</MaxVulnLimit>
1626
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1627
<MaxVarianceLimit>4</MaxVarianceLimit>
1628
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1629
<EnforceEncoding>0</EnforceEncoding>
1630
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1631
<AttackPoints>Response Analysis</AttackPoints>
1632
<ParameterLocations></ParameterLocations>
1633
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
1634
<DisplayName>Information Disclosure in scripts</DisplayName>
1635
</AttackModulePolicy>
1636
<AttackModulePolicy>
1637
<Enabled>1</Enabled>
1638
<ModuleId>07BD211A580944E591F78B40FF3F3489</ModuleId>
1639
<ModulePriority>Low</ModulePriority>
1640
<Severity>Informational</Severity>
1641
<MaxVulnLimit>250</MaxVulnLimit>
1642
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1643
<MaxVarianceLimit>3</MaxVarianceLimit>
1644
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1645
<EnforceEncoding>0</EnforceEncoding>
1646
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1647
<AttackPoints>Response Analysis</AttackPoints>
1648
<ParameterLocations></ParameterLocations>
1649
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1650
<DisplayName>Secure and non-secure content mix</DisplayName>
1651
</AttackModulePolicy>
1652
<AttackModulePolicy>
1653
<Enabled>1</Enabled>
1654
<ModuleId>1CBEA71A88844A11A4CD6ABAA2FD7F62</ModuleId>
1655
<ModulePriority>Low</ModulePriority>
1656
<Severity>Low</Severity>
1657
<MaxVulnLimit>100</MaxVulnLimit>
1658
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1659
<MaxVarianceLimit>4</MaxVarianceLimit>
1660
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1661
<EnforceEncoding>0</EnforceEncoding>
1662
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1663
<AttackPoints>Response Analysis</AttackPoints>
1664
<ParameterLocations></ParameterLocations>
1665
<RequestOriginations>HTML|Form|Silverlight</RequestOriginations>
1666
<DisplayName>Sensitive data over an insecure channel</DisplayName>
1667
</AttackModulePolicy>
1668
<AttackModulePolicy>
1669
<Enabled>1</Enabled>
1670
<ModuleId>34A0F038EFA248B594E7F17447F4CF2E</ModuleId>
1671
<ModulePriority>High</ModulePriority>
1672
<Severity>Informational</Severity>
1673
<MaxVulnLimit>10</MaxVulnLimit>
1674
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1675
<MaxVarianceLimit>1</MaxVarianceLimit>
1676
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1677
<EnforceEncoding>0</EnforceEncoding>
1678
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1679
<AttackPoints>Web Site|Response Analysis</AttackPoints>
1680
<ParameterLocations></ParameterLocations>
1681
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1682
<DisplayName>Server Configuration</DisplayName>
1683
</AttackModulePolicy>
1684
<AttackModulePolicy>
1685
<Enabled>1</Enabled>
1686
<ModuleId>DC8E0D09314B44D39915AAF8439B4F53</ModuleId>
1687
<ModulePriority>Medium</ModulePriority>
1688
<Severity>Medium</Severity>
1689
<MaxVulnLimit>150</MaxVulnLimit>
1690
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1691
<MaxVarianceLimit>4</MaxVarianceLimit>
1692
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1693
<EnforceEncoding>0</EnforceEncoding>
1694
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1695
<AttackPoints>Parameter</AttackPoints>
1696
<ParameterLocations>Directory|File|Path|Query|Fragment|Post|Cookie|Referer|Http Header</ParameterLocations>
1697
<RequestOriginations>HTML|Form|AJAX</RequestOriginations>
1698
<DisplayName>Server Side Include (SSI) Injection</DisplayName>
1699
</AttackModulePolicy>
1700
<AttackModulePolicy>
1701
<Enabled>1</Enabled>
1702
<ModuleId>0F5408AB9FF94320AA58FCFE80EDEF59</ModuleId>
1703
<ModulePriority>High</ModulePriority>
1704
<Severity>High</Severity>
1705
<MaxVulnLimit>200</MaxVulnLimit>
1706
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1707
<MaxVarianceLimit>4</MaxVarianceLimit>
1708
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1709
<EnforceEncoding>0</EnforceEncoding>
1710
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1711
<AttackPoints>Parameter</AttackPoints>
1712
<ParameterLocations>Path|Query|Post|Cookie</ParameterLocations>
1713
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1714
<DisplayName>Server Side Template Injection</DisplayName>
1715
</AttackModulePolicy>
1716
<AttackModulePolicy>
1717
<Enabled>1</Enabled>
1718
<ModuleId>DB1340E1857540219DF84A6A9DC0494C</ModuleId>
1719
<ModulePriority>High</ModulePriority>
1720
<Severity>Medium</Severity>
1721
<MaxVulnLimit>25</MaxVulnLimit>
1722
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1723
<MaxVarianceLimit>2</MaxVarianceLimit>
1724
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1725
<EnforceEncoding>0</EnforceEncoding>
1726
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1727
<AttackPoints>Web Resource</AttackPoints>
1728
<ParameterLocations></ParameterLocations>
1729
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1730
<DisplayName>Session Fixation</DisplayName>
1731
</AttackModulePolicy>
1732
<AttackModulePolicy>
1733
<Enabled>1</Enabled>
1734
<ModuleId>6B1B2812012D41249BDEE83FFAEB523D</ModuleId>
1735
<ModulePriority>Low</ModulePriority>
1736
<Severity>Low</Severity>
1737
<MaxVulnLimit>10</MaxVulnLimit>
1738
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1739
<MaxVarianceLimit>1</MaxVarianceLimit>
1740
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1741
<EnforceEncoding>0</EnforceEncoding>
1742
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1743
<AttackPoints>Parameter</AttackPoints>
1744
<ParameterLocations>Directory|Path|Query</ParameterLocations>
1745
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL</RequestOriginations>
1746
<DisplayName>HTTP Query Session Check</DisplayName>
1747
</AttackModulePolicy>
1748
<AttackModulePolicy>
1749
<Enabled>1</Enabled>
1750
<ModuleId>F729A70998064A1F99A8BEA8512D31AE</ModuleId>
1751
<ModulePriority>Medium</ModulePriority>
1752
<Severity>Low</Severity>
1753
<MaxVulnLimit>10</MaxVulnLimit>
1754
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1755
<MaxVarianceLimit>4</MaxVarianceLimit>
1756
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1757
<EnforceEncoding>0</EnforceEncoding>
1758
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1759
<AttackPoints>Web Resource</AttackPoints>
1760
<ParameterLocations></ParameterLocations>
1761
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1762
<DisplayName>Session Strength</DisplayName>
1763
</AttackModulePolicy>
1764
<AttackModulePolicy>
1765
<Enabled>1</Enabled>
1766
<ModuleId>0DB2C1311DA74B80A153A8733C74D6CC</ModuleId>
1767
<ModulePriority>Medium</ModulePriority>
1768
<Severity>Low</Severity>
1769
<MaxVulnLimit>50</MaxVulnLimit>
1770
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1771
<MaxVarianceLimit>4</MaxVarianceLimit>
1772
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1773
<EnforceEncoding>0</EnforceEncoding>
1774
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1775
<AttackPoints>Response Analysis</AttackPoints>
1776
<ParameterLocations></ParameterLocations>
1777
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1778
<DisplayName>Session Upgrade</DisplayName>
1779
</AttackModulePolicy>
1780
<AttackModulePolicy>
1781
<Enabled>1</Enabled>
1782
<ModuleId>7A7B3239AB8146839A8AEF170807ED1E</ModuleId>
1783
<ModulePriority>Low</ModulePriority>
1784
<Severity>Medium</Severity>
1785
<MaxVulnLimit>100</MaxVulnLimit>
1786
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1787
<MaxVarianceLimit>4</MaxVarianceLimit>
1788
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1789
<EnforceEncoding>0</EnforceEncoding>
1790
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1791
<AttackPoints>File</AttackPoints>
1792
<ParameterLocations></ParameterLocations>
1793
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1794
<DisplayName>Source Code Disclosure</DisplayName>
1795
</AttackModulePolicy>
1796
<AttackModulePolicy>
1797
<Enabled>1</Enabled>
1798
<ModuleId>59646365E0E44520BE4297C3ABAA7E75</ModuleId>
1799
<ModulePriority>High</ModulePriority>
1800
<Severity>Low</Severity>
1801
<MaxVulnLimit>250</MaxVulnLimit>
1802
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1803
<MaxVarianceLimit>4</MaxVarianceLimit>
1804
<PassiveAnalysisOnAttacks>1</PassiveAnalysisOnAttacks>
1805
<EnforceEncoding>0</EnforceEncoding>
1806
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1807
<AttackPoints>Response Analysis</AttackPoints>
1808
<ParameterLocations></ParameterLocations>
1809
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1810
<DisplayName>SQL Information Leakage</DisplayName>
1811
</AttackModulePolicy>
1812
<AttackModulePolicy>
1813
<Enabled>1</Enabled>
1814
<ModuleId>B6F559D374B5451EB424A1C1FB264FA6</ModuleId>
1815
<ModulePriority>High</ModulePriority>
1816
<Severity>High</Severity>
1817
<MaxVulnLimit>500</MaxVulnLimit>
1818
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1819
<MaxVarianceLimit>4</MaxVarianceLimit>
1820
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1821
<EnforceEncoding>0</EnforceEncoding>
1822
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1823
<AttackPoints>Parameter</AttackPoints>
1824
<ParameterLocations>Directory|File|Path|Query|Post|Cookie|Referer|Http Header</ParameterLocations>
1825
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1826
<DisplayName>SQL Injection</DisplayName>
1827
</AttackModulePolicy>
1828
<AttackModulePolicy>
1829
<Enabled>1</Enabled>
1830
<ModuleId>0496353D92704F2E942BFE1B575D9B7C</ModuleId>
1831
<ModulePriority>High</ModulePriority>
1832
<Severity>High</Severity>
1833
<MaxVulnLimit>25</MaxVulnLimit>
1834
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1835
<MaxVarianceLimit>4</MaxVarianceLimit>
1836
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1837
<EnforceEncoding>0</EnforceEncoding>
1838
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1839
<AttackPoints>Parameter</AttackPoints>
1840
<ParameterLocations>Path|Query|Post</ParameterLocations>
1841
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1842
<DisplayName>SQL Injection Auth Bypass</DisplayName>
1843
</AttackModulePolicy>
1844
<AttackModulePolicy>
1845
<Enabled>1</Enabled>
1846
<ModuleId>CEB40EE490564D60B4F9B3CE79C009B5</ModuleId>
1847
<ModulePriority>Medium</ModulePriority>
1848
<Severity>Medium</Severity>
1849
<MaxVulnLimit>100</MaxVulnLimit>
1850
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1851
<MaxVarianceLimit>4</MaxVarianceLimit>
1852
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1853
<EnforceEncoding>0</EnforceEncoding>
1854
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1855
<AttackPoints>Response Analysis</AttackPoints>
1856
<ParameterLocations></ParameterLocations>
1857
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1858
<DisplayName>SQL Parameter Check</DisplayName>
1859
</AttackModulePolicy>
1860
<AttackModulePolicy>
1861
<Enabled>1</Enabled>
1862
<ModuleId>C5805272001249A095A48F2E56240C10</ModuleId>
1863
<ModulePriority>Medium</ModulePriority>
1864
<Severity>Informational</Severity>
1865
<MaxVulnLimit>25</MaxVulnLimit>
1866
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1867
<MaxVarianceLimit>1</MaxVarianceLimit>
1868
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1869
<EnforceEncoding>0</EnforceEncoding>
1870
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1871
<AttackPoints>Web Site</AttackPoints>
1872
<ParameterLocations></ParameterLocations>
1873
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1874
<DisplayName>SSL Strength</DisplayName>
1875
</AttackModulePolicy>
1876
<AttackModulePolicy>
1877
<Enabled>1</Enabled>
1878
<ModuleId>5D9A66E5961B4644AAF5EC655E18EE66</ModuleId>
1879
<ModulePriority>Medium</ModulePriority>
1880
<Severity>Informational</Severity>
1881
<MaxVulnLimit>50</MaxVulnLimit>
1882
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1883
<MaxVarianceLimit>20</MaxVarianceLimit>
1884
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1885
<EnforceEncoding>0</EnforceEncoding>
1886
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1887
<AttackPoints>Web Site</AttackPoints>
1888
<ParameterLocations></ParameterLocations>
1889
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1890
<DisplayName>Subdomain discovery</DisplayName>
1891
</AttackModulePolicy>
1892
<AttackModulePolicy>
1893
<Enabled>1</Enabled>
1894
<ModuleId>9A22444AC7C642ABBC598CBCA4738C3B</ModuleId>
1895
<ModulePriority>High</ModulePriority>
1896
<Severity>Medium</Severity>
1897
<MaxVulnLimit>40</MaxVulnLimit>
1898
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1899
<MaxVarianceLimit>4</MaxVarianceLimit>
1900
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1901
<EnforceEncoding>0</EnforceEncoding>
1902
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1903
<AttackPoints>Parameter</AttackPoints>
1904
<ParameterLocations>Path|Query|Post|Cookie</ParameterLocations>
1905
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1906
<DisplayName>Unvalidated Redirect</DisplayName>
1907
</AttackModulePolicy>
1908
<AttackModulePolicy>
1909
<Enabled>1</Enabled>
1910
<ModuleId>B69E83831D26496BB2CC0C0D70181EC3</ModuleId>
1911
<ModulePriority>High</ModulePriority>
1912
<Severity>Low</Severity>
1913
<MaxVulnLimit>40</MaxVulnLimit>
1914
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1915
<MaxVarianceLimit>4</MaxVarianceLimit>
1916
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1917
<EnforceEncoding>0</EnforceEncoding>
1918
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1919
<AttackPoints>Response Analysis</AttackPoints>
1920
<ParameterLocations></ParameterLocations>
1921
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1922
<DisplayName>URL rewriting</DisplayName>
1923
</AttackModulePolicy>
1924
<AttackModulePolicy>
1925
<Enabled>1</Enabled>
1926
<ModuleId>4DE84100F31849A7B845FE5F62D2FD7A</ModuleId>
1927
<ModulePriority>Medium</ModulePriority>
1928
<Severity>Medium</Severity>
1929
<MaxVulnLimit>25</MaxVulnLimit>
1930
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1931
<MaxVarianceLimit>2</MaxVarianceLimit>
1932
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1933
<EnforceEncoding>0</EnforceEncoding>
1934
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1935
<AttackPoints>Response Analysis</AttackPoints>
1936
<ParameterLocations></ParameterLocations>
1937
<RequestOriginations>HTML|Form</RequestOriginations>
1938
<DisplayName>ASP.NET ViewState security</DisplayName>
1939
</AttackModulePolicy>
1940
<AttackModulePolicy>
1941
<Enabled>1</Enabled>
1942
<ModuleId>0BE4C251F44C4CF1924104ADFD86289C</ModuleId>
1943
<ModulePriority>Low</ModulePriority>
1944
<Severity>Informational</Severity>
1945
<MaxVulnLimit>100</MaxVulnLimit>
1946
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1947
<MaxVarianceLimit>4</MaxVarianceLimit>
1948
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1949
<EnforceEncoding>0</EnforceEncoding>
1950
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1951
<AttackPoints>Web Resource</AttackPoints>
1952
<ParameterLocations></ParameterLocations>
1953
<RequestOriginations>HTML|Form|Flash|Silverlight</RequestOriginations>
1954
<DisplayName>Web Beacon</DisplayName>
1955
</AttackModulePolicy>
1956
<AttackModulePolicy>
1957
<Enabled>1</Enabled>
1958
<ModuleId>667629EC1FDC4C6D98B5F4031717BB9B</ModuleId>
1959
<ModulePriority>Medium</ModulePriority>
1960
<Severity>Low</Severity>
1961
<MaxVulnLimit>250</MaxVulnLimit>
1962
<MaxPerWebSiteVulnLimit>50</MaxPerWebSiteVulnLimit>
1963
<MaxVarianceLimit>4</MaxVarianceLimit>
1964
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1965
<EnforceEncoding>0</EnforceEncoding>
1966
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1967
<AttackPoints>Directory</AttackPoints>
1968
<ParameterLocations></ParameterLocations>
1969
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST|RecrawlTraffic</RequestOriginations>
1970
<DisplayName>Web DAV Flaws Check</DisplayName>
1971
</AttackModulePolicy>
1972
<AttackModulePolicy>
1973
<Enabled>1</Enabled>
1974
<ModuleId>74FB936F2BBA499F8D0AF3B7A29B4F9E</ModuleId>
1975
<ModulePriority>High</ModulePriority>
1976
<Severity>Low</Severity>
1977
<MaxVulnLimit>30</MaxVulnLimit>
1978
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1979
<MaxVarianceLimit>4</MaxVarianceLimit>
1980
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1981
<EnforceEncoding>0</EnforceEncoding>
1982
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1983
<AttackPoints>Web Site</AttackPoints>
1984
<ParameterLocations></ParameterLocations>
1985
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
1986
<DisplayName>Cross-site tracing (XST)</DisplayName>
1987
</AttackModulePolicy>
1988
<AttackModulePolicy>
1989
<Enabled>1</Enabled>
1990
<ModuleId>377030BFE58A4F01A112295D32A0744C</ModuleId>
1991
<ModulePriority>High</ModulePriority>
1992
<Severity>Medium</Severity>
1993
<MaxVulnLimit>250</MaxVulnLimit>
1994
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
1995
<MaxVarianceLimit>4</MaxVarianceLimit>
1996
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
1997
<EnforceEncoding>0</EnforceEncoding>
1998
<ApplyPolicySeverity>0</ApplyPolicySeverity>
1999
<AttackPoints>Parameter</AttackPoints>
2000
<ParameterLocations>Post</ParameterLocations>
2001
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
2002
<DisplayName>Web Service Parameter Fuzzing</DisplayName>
2003
</AttackModulePolicy>
2004
<AttackModulePolicy>
2005
<Enabled>1</Enabled>
2006
<ModuleId>8399FA8EDF5C41BC9D3CF85DC23DC26B</ModuleId>
2007
<ModulePriority>Low</ModulePriority>
2008
<Severity>Informational</Severity>
2009
<MaxVulnLimit>20</MaxVulnLimit>
2010
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
2011
<MaxVarianceLimit>2</MaxVarianceLimit>
2012
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
2013
<EnforceEncoding>0</EnforceEncoding>
2014
<ApplyPolicySeverity>0</ApplyPolicySeverity>
2015
<AttackPoints>Response Analysis</AttackPoints>
2016
<ParameterLocations></ParameterLocations>
2017
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
2018
<DisplayName>X-Content-Type-Options</DisplayName>
2019
</AttackModulePolicy>
2020
<AttackModulePolicy>
2021
<Enabled>1</Enabled>
2022
<ModuleId>3E2E60F7D0E04D8596918C2D1F639064</ModuleId>
2023
<ModulePriority>Low</ModulePriority>
2024
<Severity>Informational</Severity>
2025
<MaxVulnLimit>50</MaxVulnLimit>
2026
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
2027
<MaxVarianceLimit>2</MaxVarianceLimit>
2028
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
2029
<EnforceEncoding>0</EnforceEncoding>
2030
<ApplyPolicySeverity>0</ApplyPolicySeverity>
2031
<AttackPoints>Response Analysis</AttackPoints>
2032
<ParameterLocations></ParameterLocations>
2033
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
2034
<DisplayName>X-Frame-Options</DisplayName>
2035
</AttackModulePolicy>
2036
<AttackModulePolicy>
2037
<Enabled>1</Enabled>
2038
<ModuleId>615D72F401BC447AB4A2139654BC9945</ModuleId>
2039
<ModulePriority>Low</ModulePriority>
2040
<Severity>Informational</Severity>
2041
<MaxVulnLimit>25</MaxVulnLimit>
2042
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
2043
<MaxVarianceLimit>2</MaxVarianceLimit>
2044
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
2045
<EnforceEncoding>0</EnforceEncoding>
2046
<ApplyPolicySeverity>0</ApplyPolicySeverity>
2047
<AttackPoints>Response Analysis</AttackPoints>
2048
<ParameterLocations></ParameterLocations>
2049
<RequestOriginations>HTML|Form|AJAX|Flash|Silverlight|WSDL|REST</RequestOriginations>
2050
<DisplayName>X-XSS-Protection</DisplayName>
2051
</AttackModulePolicy>
2052
<AttackModulePolicy>
2053
<Enabled>1</Enabled>
2054
<ModuleId>ABFA075919804435A25A22A8CAC191DF</ModuleId>
2055
<ModulePriority>High</ModulePriority>
2056
<Severity>Medium</Severity>
2057
<MaxVulnLimit>100</MaxVulnLimit>
2058
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
2059
<MaxVarianceLimit>4</MaxVarianceLimit>
2060
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
2061
<EnforceEncoding>0</EnforceEncoding>
2062
<ApplyPolicySeverity>0</ApplyPolicySeverity>
2063
<AttackPoints>Parameter</AttackPoints>
2064
<ParameterLocations>Path|Query|Post|Cookie</ParameterLocations>
2065
<RequestOriginations>HTML|Form|AJAX</RequestOriginations>
2066
<DisplayName>XML External Entity Attack</DisplayName>
2067
</AttackModulePolicy>
2068
<AttackModulePolicy>
2069
<Enabled>1</Enabled>
2070
<ModuleId>BBE9F36A88A944ECB837D5193D356E4C</ModuleId>
2071
<ModulePriority>Medium</ModulePriority>
2072
<Severity>High</Severity>
2073
<MaxVulnLimit>100</MaxVulnLimit>
2074
<MaxPerWebSiteVulnLimit>500</MaxPerWebSiteVulnLimit>
2075
<MaxVarianceLimit>4</MaxVarianceLimit>
2076
<PassiveAnalysisOnAttacks>0</PassiveAnalysisOnAttacks>
2077
<EnforceEncoding>0