Modern web applications often rely on a third party service as a backend when they are built with a micro-service architecture or using a third party SaaS service. In such deployments, it is recommended to perform additional scans directly against these backend hosts (with the consent and approval of their respective owners and hosting companies) to ensure a wide coverage of the web applications services in use.

An external URL is an URL for which the Fully Qualified Domain Name (FQDN) is not the same as the web target URL one. The scanner detected the presence of external URLs on the target web application and have listed them based on two types : URLs with a domain name in common with the web target URL and all the other external URLs.

This finding provides information to assist in scan performance tuning.

A Web Application Firewall (WAF) has been detected during the scan. A WAF is designed to help protecting web applications by monitoring and filtering HTTP(S) traffic through a set of rules in order to prevent the most common attacks.

. The identified WAF may have blocked several requests during the vulnerability assessment or have declined access to some resources of the web application during the scan (blocked URLs have been provided in the plugin attachments).

It is recommended to scan the web application by ensuring that the traffic coming from the scanner is allowed by the WAF in order to get the most accurate coverage of the target application vulnerabilities. If needed, the Tenable WAS documentation defines the scanners IP ranges to be allowed in the WAF configuration.

Some DOM elements matched one or more entries in the DOM Exclusion list and therefore were excluded from interactions.

The scan detected that some XHR requests seem to call an API. The scanner generated an OpenAPI file based on the observed requests and attached it to the plugin output. This OpenAPI file can then be used to run a scan against the API with WAS API Scanning.

Requests to the URI were blocked due to a matching Exclusion rule.

OpenAPI file could not be imported and cannot be used during the scan.

OpenAPI file was successfully imported and can be used during the scan.

The scan detected that the web application makes requests that appear to be using Fetch or XMLHTTPRequests (XHRs) to communicate with a backend API server. Fetchs/XHRs allow retrieval of data from an API without triggering a page reload, making them especially useful for Single Page Applications.

This is an informational notice that by investigating the response headers from the remote host, it is possible to guess the name of the remote operating system in use. It is also possible sometimes to guess the version of the operating system.

This plugin is raised when the scanner has not been able to crawl the web application using the Selenium scripts provided in the scan policy.

Check the output of the plugin to get an explanation of the issue encountered by the scan.

This is an informational notice that the scanner was able to successfully perform the crawling scripts provided in the policy.

Screenshot of the target web page, see attached image. This screenshot should show you the target page we are launching the scan against. If the image is not of the intended target page, please check the provided url in the scan configuration.

Provides a report of network timeouts encountered during the scan, showing URLs and the number of timeouts for each URL.

Note that assessment will stop on any URLs in timeout state, and timeouts may increase significantly the overall duration of the scan.

Publishes the target information of the starting url as evaluated by the scan.

The scanner aborted the scan due to the number of consecutive timeouts received from the web application, to prevent this latter to be completely unresponsive and unable to process normal requests.

Publishes the sitemap of the web application as seen by the scan.

The list of all URLs that have been detected during the scan are available as an attachment. For each URL in the sitemap, the following information is provided:

- The first time the URL is detected - The logic used to detect the URL. This information may be found by: crawling rendering the page by a specific plugin - The parent URL requested to detect the URL - If the URL has been requested at least once, information about the response - Whether or not the URL has been queued for audit - If the URL has not been queued for audit, the reason why the URL does not need an audit - Whether or not the URL has been effectively audited - If the URL has not been effectively audited, the reason that the scanner was unable to audit the URL


Reasons for not adding a URL to the audit queue are as follows:

- not_in_domain: The domain of the URL does not match main target URL - scope_configuration: The URL does not match scope include list scan settings - directory_depth: The number of directories in the URL path exceeds the scan configuration setting - exclude_file_extension: The URL file extension matched one entry of the file extension blacklist setting - exclude_path_patterns: The URL matched one entry of the URL exclusion blacklist setting - redundant_path: The number of URLs to be audited with the same path and query string parameters has been reached - request_redirect_limit: The number of HTTP redirects allowed per scan configuration setting has been reached - queue_full: The number of URLs to audit has been reached


If a scan fails to audit a URL that has been queued for audit, reasons for the failure are as follows:

- timeout: The request timed out when trying to retrieve URL contents - filesize_exceeded: URL response exceeded file size limit defined in the scan configuration - scan_timelimit_reached: The URL couldn’t be audited before the scan time limit - user_abort: The user stopped the scan before the URL could be audited

Provides scan information and statistics of plugins run.

ID	Name	Severity
114128	External Backend API Detected	info
98154	External URLs	info
113393	Performance Telemetry	info
98008	Web Application Firewall Detected	info
98111	DOM Elements Excluded	info
112616	API Detected	info
98007	URI Blocked Due to Exclusion Rule	info
112570	OpenAPI Import Failed	info
112569	OpenAPI Import Success	info
98772	Fetch/XHR Detected	info
98003	OS Detection	info
98145	Selenium Crawl Failed	info
98143	Selenium Crawl Succeeded	info
98138	Screenshot	info
98019	Network Timeout Encountered	info
98136	Target Information	info
98137	Scan aborted after too many timeouts	info
98009	Web Application Sitemap	info
98000	Scan Information	info

Detections

Analytics

General Family for Web App Scanning

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info