Assessment Settings in Tenable PCI ASV

• General Settings:
  • Avoid false alarms
  • Disable CGI scanning
• Web Applications:
  • Disable web application scanning

Scan for known web vulnerabilities

• General Settings:
  • Avoid potential false alarms
  • Enable CGI scanning
• Web Applications:
  • Start crawling from "/"
  • Crawl 1000 pages (max)
  • Traverse 6 directories (max)
  • Test for known vulnerabilities in commonly used web applications
  • Generic web application tests disabled

• General Settings:
  • Avoid potential false alarms
  • Enable CGI scanning
• Web Applications:
  • Start crawling from "/"
  • Crawl 1000 pages (max)
  • Traverse 6 directories (max)
  • Test for known vulnerabilities in commonly used web applications
  • Perform each generic web app test for 5 minutes (max)

• General Settings:
  • Avoid potential false alarms
  • Enable CGI scanning
  • Perform thorough tests
• Web Applications:
  • Start crawling from "/"
  • Crawl 1000 pages (max)
  • Traverse 6 directories (max)
  • Test for known vulnerabilities in commonly used web applications
  • Perform each generic web app test for 10 minutes (max)
  • Try all HTTP methods
  • Attempt HTTP Parameter Pollution

-

In some cases, Tenable PCI ASV cannot remotely determine whether a flaw is present or not. If report paranoia is set to Show potential false alarms, a flaw is reported every time, even when there is a doubt about the remote host being affected. Conversely, a paranoia setting of Avoid potential false alarms causes Tenable PCI ASV to not report any flaw whenever there is a hint of uncertainty about the remote host. As a middle ground between these two settings, disable this setting.

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)

Specifies which type of web browser Tenable PCI ASV impersonates while scanning.

/

The URL of the first page that is tested. If multiple pages are required, use a colon delimiter to separate them (e.g., /:/php4:/base).

Specifies portions of the web site to exclude from being crawled. For example, to exclude the /manual directory and all Perl CGI, set this field to: (^/manual) <> (\.pl(\?.*)?$).

Tenable PCI ASV supports POSIX regular expressions for string matching and handling, as well as Perl-compatible regular expressions (PCRE).

1000

The maximum number of pages to crawl.

6

Limit the number of links Tenable PCI ASV follows for each start page.

Disabled

If selected, Tenable PCI ASV follows dynamic links and may exceed the parameters set above.

This setting manages the combination of argument values used in the HTTP requests. The default, without checking this option, is testing one parameter at a time with an attack string, without trying non-attack variations for additional parameters. For example, Tenable PCI ASV would attempt
/test.php?arg1=XSS&b=1&c=1, where b and c allow other values, without testing each combination. This is the quickest method of testing with the smallest result set generated.

This setting has four options:

• Test random pairs of parameters: This form of testing randomly checks a combination of random pairs of parameters. This is the fastest way to test multiple parameters.
• Test all pairs of parameters (slow): This form of testing is slightly slower but more efficient than the one value test. While testing multiple parameters, it tests an attack string, variations for a single variable and then use the first value for all other variables. For example, Tenable PCI ASV would attempt /test.php?a=XSS&b=1&c=1&d=1 and then cycle through the variables so that one is given the attack string, one is cycled through all possible values (as discovered during the mirror process) and any other variables are given the first value. In this case, Tenable PCI ASV would never test for /test.php?a=XSS&b=3&c=3&d=3 when the first value of each variable is 1.
• Test random combinations of three or more parameters (slower): This form of testing randomly checks a combination of three or more parameters. This is more thorough than testing only pairs of parameters. Increasing the amount of combinations by three or more increases the web application test time.
• Test all combinations of parameters (slowest): This method of testing checks all possible combinations of attack strings with valid input to variables. Where all pairs testing seeks to create a smaller data set as a tradeoff for speed, all combinations makes no compromise on time and uses a complete data set of tests. This testing method may take a long time to complete.
  

This setting determines when a new flaw is targeted. This applies at the script level. Finding an XSS flaw does not disable searching for SQL injection or header injection, but unless otherwise specified, there is at most one report for each type on a given port. Note that several flaws of the same type (for example, XSS or SQLi) may be reported if they were caught by the same attack.

If this option is disabled, as soon as a flaw is found on a web page, the scan moves on to the next web page.

If you enable this option, select one of the following options:

• Stop after one flaw is found per web server (fastest) — (Default) As soon as a flaw is found on a web server by a script, Tenable PCI ASV stops and switches to another web server on a different port.
• Stop after one flaw is found per parameter (slow) — As soon as one type of flaw is found in a parameter of a CGI (for example, XSS), Tenable PCI ASV switches to the next parameter of the same CGI, the next known CGI, or to the next port or server.
• Look for all flaws (slowest) — Perform extensive tests regardless of flaws found. This option can produce a very verbose report and is not recommend in most cases.

If enabled, domain users are queried instead of local users.

You can enable as many of the user enumeration methods as appropriate for user discovery.