Advanced Settings in Tenable Web App Scanning Scans
Advanced settings specify additional controls you want to implement in a web application scan.
You can configure Advanced settings when you create a scan or user-defined scan template using any Tenable-provided scan template. However, the Overview and Scan template types have more configurable Advanced settings than the Config Audit and SSL TLS template types. For more information, see Scan Templates.
The Advanced Settings options allow you to control the efficiency and performance of the scan.
- General
- HTTP Settings
- Screen Settings
- Limits
- Selenium Settings
- Performance Settings
- Session Settings
You can configure General options in scans and user-defined scan templates based on the Overview and Scan templates only.
| Setting | Default | Description |
|---|---|---|
| Target Scan Max Time (HH:MM:SS) | 08:00:00 |
Specifies the maximum duration the scanner runs a scan job runs before stopping, displayed in hours, minutes, and seconds. Note: The maximum duration you can set is 99:59:59 (hours: minutes: seconds).
|
| Maximum Queue Time (HH:MM:SS) | 08:00:00 |
Specifies the maximum duration the scan remains in the Queued state, displayed in hours, minutes, and seconds. Note: The maximum duration you can set is 48:00:00 (hours: minutes: seconds).
|
|
Enable Debug logging for this scan |
disabled | Specifies whether the scanner attaches available debug logs from plugins to the vulnerability output of this scan. |
|
Debug Flags |
disabled | (Only visible when you enable the Enable Debug logging for this scan feature). Allows you to specify key and value pairs, provided by support, for debugging. |
These settings specify the user-agent you want the scanner to identify and the HTTP response headers you want the scanner to include in requests to the web application.
You can configure Crawl Settings options in scans and user-defined scan templates based on any Tenable-provided scan template.
| Setting | Default | Description |
|---|---|---|
| Use a different User Agent to identify scanner | disabled |
Specifies whether you want the scanner to use a user-agent header other than Chrome when sending an HTTP request. |
| User Agent | Chrome's user-agent |
Specifies the name of the user-agent header you want the scanner to use when sending an HTTP request. You can configure this option only after you select the Use a different User Agent to identify scanner checkbox. By default, Tenable Web App Scanning uses the user-agent that Chrome uses for the operating system and platform that corresponds to your machine's operating system and platform. For more information about Chrome's user-agents, see the Google Chrome Documentation. Note: Specific version numbers are subject to change as components are updated. The current Tenable Web App Scanning user-agent header looks similar to:
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.4.5678.900 Safari/537.36 Note: Not all requests from a scanner are guaranteed to have the User Agent sent.
|
| Add Scan ID HTTP Header | disabled |
Specifies whether the scanner adds an additional X-Tenable-Was-Scan-Id header (set with the scan ID) to all HTTP requests sent to the target, which allows you to identify scan jobs in web server logs and modify your scan configurations to secure your sites. |
| Custom Headers | none |
Specifies the custom headers you want to inject into each HTTP request, in request and response format. You can add additional custom headers by clicking the Note: If you enter a custom User-Agent header, that value overrides the value entered in the User Agent setting box. |
button and typing the values for each additional header. You can configure Screen Settings options in scans and user-defined scan templates based on the Overview and Scan templates only.
| Setting | Default | Description |
|---|---|---|
|
Screen Width |
1600 |
Specifies the screen width, in pixels, of the browser embedded in the scanner. |
|
Screen Height |
1200 |
Specifies the screen height, in pixels, of the browser embedded in the scanner. |
|
Ignore Images |
disabled |
Specifies if the browser embedded in the scanner crawls or ignores images on your target web pages. |
You can configure Limits options in scans and user-defined scan templates based on the Overview and Scan templates only.
| Setting | Default | Description |
|---|---|---|
| Number of URLS to Crawl and Browse | 10000 | Specifies the maximum number of URLs the scanner attempts to crawl. |
| Path Directory Depth | 10 |
Specifies the maximum number of sub-directories the scanner crawls. For example, if your target is www.example.com, and you want the scanner to crawl www.example.com/users/myname, type 2 in the text box. |
| Page DOM Element Depth | 5 | Specifies the maximum number of HTML nested element levels the scanner crawls. |
| Max Response Size | 500000 | Specifies the maximum load size of a page, in bytes, which the scanner analyzes. If the scanner crawls a URL and the response exceeds the limit, the scanner does not analyze the page for vulnerabilities. |
| Request Redirect Limit | 3 | Specifies the number of redirects the scanner follows before it stops trying to crawl the page. |
These settings specify how the scanner behaves when it attempts to authenticate to a web application using your recorded Selenium credentials.
Configure these options if you configured your scan to authenticate to the web application with Selenium credentials. For more information see Credentials in Tenable Web App Scanning Scans.
You can configure Selenium Settings options in scans and user-defined scan templates based on the Overview and Scan templates only.
| Setting | Default | Description |
|---|---|---|
| Page Rendering Delay | 30000 | Specifies the time (in milliseconds) the scanner waits for the page to render. |
| Command Execution Delay | 500 |
Specifies the time (in milliseconds) the scanner waits after processing a command before proceeding to the next command. |
| Script Completion Delay | 5000 | Specifies the time (in milliseconds) the scanner waits for all commands to render new content to finish processing. |
| Setting | Default | Description |
|---|---|---|
| Max Number of Concurrent HTTP Connections | 10 | Specifies the maximum number of established HTTP sessions allowed for a single host. |
| Max Number of HTTP Requests Per Second | 25 |
Specifies the maximum number of HTTP requests allowed for a single host for the duration of the scan. Note: The scanner utilizes a set of web browsers in addition to the main HTTP client, and these web browsers are not rate-limited. |
| Slow down the scan when network congestion is detected | disabled | Specifies whether the scanner throttles the scan in the event of network congestion. |
| Network Timeout (In Seconds) | 30 |
Specifies the time, in seconds, the scanner waits for a response from a host before aborting the scan, unless otherwise specified in a plugin. If your internet connection is slow, Tenable recommends that you specify a longer wait time. |
| Browser Timeout (In Seconds) | 60 |
Specifies the time, in seconds, the scanner waits for a response from a browser before aborting the scan, unless otherwise specified in a plugin. If your internet connection is slow, Tenable recommends that you specify a longer wait time. |
| Timeout Threshold | 100 | Specifies the number of consecutive timeouts allowed before the scanner aborts the scan. |
Specifying these tokens speeds up the scan by allowing the scanner to skip token verification. Session Settings are only available when you are editing an existing scan.
| Token Type | Default | Description |
|---|---|---|
| Cookie | None |
Name of your application's authentication cookie for the scanner to use. |
| Header | None |
Name of your application's authentication header for the scanner to use. |