Module Configuration File Reference

The following table describes the Module Configuration file elements:

ElementDescription
ModuleIdA GUID that identifies the module.
DisplayNameThe name of the module as it is presented to the user.
ModuleDescriptionThe description of the module that will be shown to the user.
ModuleFormatThe format of the module. Valid values are: C#
LocationThe location of the module binary code. Valid values are:
  • <name of the module DLL>
  • Internal
ModuleTypesThe type of module. Valid values are:
  • Active (has attacks that send requests)
  • Passive (has attacks that do not send requests)
Multiple values can be set. To set multiple values, the values should be separated by | character, as follows:
Active | Passive
ModulePriorityThe priority of the module. This value is used to schedule attacks with higher priority before attacks with lower priority. Valid values are:
  • High
  • Medium
  • Low
AttackModulePolicyThis is the default attack module policy that is placed in every scan configuration file for this module. It can be modified in the scan configuration, and it is the policy in the scan configuration that is used at run time.
AttackModulePolicy.EnabledSpecifies if the module should be enabled by default.
AttackModulePolicy.ModuleIdThe GUID of the module. This is the same GUID as in ModuleId at the beginning of the page.
AttackModulePolicy.ModulePriorityDefault module priority. Valid values are:
  • High
  • Medium
  • Low
AttackModulePolicy.SeverityDefault severity of module findings. Valid values are:
  • Safe
  • Informational
  • Low
  • Medium
  • High
AttackModulePolicy.MaxVulnLimitMaximum number of vulnerabilities found by module after which AppSpider will stop running the module attacks for the scan.
AttackModulePolicy.MaxVarianceLimitMaximum number of attack variances per root cause that AppSpider will try to create.
AttackModulePolicy. PassiveAnalysisOnAttacksThis element is obsolete and is not functional.
AttackModulePolicy. EnforceEncodingFlags that tells AppSpider if it should encode attack payload.
AttackModulePolicy.AttackPointsDescribed default attack point that should be attacked by this module. Valid values are:
  • Web Site
  • Directory
  • File
  • Web Resource
  • Parameter
  • Response Analysis
Note that multiple values can be set. To set multiple values, the values should be separated by | character, as follows:
Web Site | Directory | Parameter
N.B. The “Web Resource” string here correlates to the CrawlResult attack point in the API.
AttackModulePolicy. ParameterLocationsThe default parameter locations that should be attacked by this module. Valid values are:
  • Directory
  • File
  • Path
  • Query
  • Fragment
  • Post
  • Http Header
  • Cookie
  • Referer
Multiple values can be set. To set multiple values, the values should be separated by | character, as follows:
Query | Post | Cookie
AttackModulePolicy. RequestOriginationsThe default request originations for which this module should be used.
Valid values are:
  • HTML
  • Form
  • AJAX
  • Flash
  • Silverlight
  • WSDL
Multiple values can be set. To set multiple values, the values should be separated by | character, as follows:
Flash | Silverlight
DefaultAttackConfigDescribes default attack configuration. This structure contains default values of the parameters declared in AttackConfig structure in attacks.cfg file.
DescriptionListList of vulnerability descriptions that are referenced from attack configurations.
RecommendationListList of vulnerability recommendations that are referenced from attack configurations.
CustomParameterListList of module-wide parameters that can be used to parameterize the module. The names and format of the parameters are defined by module writers.