Using wi.exe

You can initiate several Fortify WebInspect functions by way of a command-line interface (CLI) using the program wi.exe. Use the following syntax when typing a command:

wi.exe -u url [-api type] [-s file] [-ws file] [-Framework name] 
       [-CrawlCoverage name] [-ps policyID | -pc path] 
       [-ab|ac|an|ad|aa|ak|at creds] [-macro path] [-o|c] [-n name]  
       [-e[abcdefghijklmnopst] file] [-x|xd|xa|xn] [-b filepath] [-db] 
       [-d filepath -m filename] [-i[erxd] scanid | -ic scanid scanname 
       | -im option scanid scanlist] [-r report_name -y report_type 
       -w report_favorite -f report_export_file -g[phacxe] 
       [-t compliance_template_file] [-v] [-?]

To run multiple scans from the command line, create and execute a batch file, using a format similar to the following:

c:
cd \program files\Fortify\Fortify WebInspect
wi.exe -u http://172.16.60.19 -ps 4
wi.exe -u http://www.mywebsite.com
wi.exe -u http://172.16.60.17
wi.exe -u http://172.16.60.16

Options

The options are defined in the following table. Items in italics require a value.

Category	Options	Definition
General	`-?`	Displays the usage help.
	`-u {url}`	Specifies the start URL or IP address. Caution! When using the `-u` parameter with `-s` (a settings file), be sure to specify an `-x`, `-xa`, `-xd`, or `-xn` parameter to restrict a scan to folders, if desired. Failure to do so may result in an unrestricted audit under certain conditions. If the URL contains an ampersand (&), you must enclose the URL within quotation marks.
	`-api {type}`	Specifies the API type to be scanned. Valid values for type are: `GraphQL` `gRPC` `OData` `SOAP` `Swagger` Important! You must provide the URL to the Swagger or OData definition file, as shown in the following example: `-u http://172.16.81.36/v1 -api Swagger` Important! For the `-u` option, you can point to a definition file or an endpoint for the service, as shown in the following example: `-u http://172.16.81.36/v1 -api Swagger` Optionally, you can create a scan configuration file with additional information, such as authentication and proxy settings, and point to the settings file in the command. For more information, see Scanning an API with wi.exe.
	`-s {filename}`	Specifies the settings file. Settings file types are JSON and XML. Note: Command line parameters take precedence over values in a settings file.
	`-db`	Indicates to use the database defined in settings file. If omitted, Fortify WebInspect defaults to database connection defined in application settings.
	`-ws {filename}`	Identifies the Web Service Design file to use.
	`-o`	Specifies an Audit-only scan.
	`-c`	Specifies a Crawl-only scan.
	`-n {name}`	Specifies the scan name.
	`-b {filepath}`	Specifies the SecureBase file to use. For path, specify the full path and file name.
	`-d {filepath}`	Moves the database to the specified filepath.
	`-m {filename}`	Moves the database to specified filename.
	`-v`	Creates verbose output.
	`-l`	Disables telemetry data collection (for this scan only).
	`-tm`	Enables the Traffic Monitor (Traffic Viewer) for the scan. Important! The Traffic Monitor requires the traffic session file (`.tsf`) from the scan. If a scan with Traffic Monitor enabled needs to be exported to a scan file in the `.scan` format, use the `-et` option to export all scan logs, including the traffic session file.
	`-ie {scanid}`	Starts configured scan with the specified scan ID (GUID).
	`-ir {scanid}`	Resumes scan with the specified scan ID (GUID).
	`-ix {scanid}`	Uses existing scan with the specified scan ID (GUID), but does not continue the scan.
	`-id {scanid}`	Deletes scan with the specified scan ID (GUID).
	`-ii {scanid} {file path}`	Imports scan. Note: This parameter is not supported in Fortify WebInspect on Docker.
Restrict to Root Folder	`-x`	Restricts scan to directory only (self).
	`-xa`	Restricts scan to directory and parents (ancestors).
	`-xd`	Restricts scan to directory and subdirectories (descendants).
	`-xn`	Ignores “restrict to folder” rules in referenced settings file. Restrict to folder parameters (`x`\|`xa`\|`xb`\|`xn`) can be in their own category (as report or output).
Framework	`-framework {framework_name}`	Specifies name of framework; currently only Oracle ADF Faces (Oracle) and IBM WebSphere Portal (WebSpherePortal) are supported. Optimizes scanning of application built with either of these technologies.
Crawl Coverage	`-CrawlCoverage {Coveragename}`	Specifies the type of scan coverage. Values for Coveragename are: `Thorough` = Exhaustive crawl of entire site `Default` = Focus more on coverage than performance `Moderate` = Balance of coverage and speed `Quick` = Focus on breadth and performance
Audit Policy	`-ps {policy id}`	Identifies the non-custom policy to use. Values for policy id are as follows: Best Practices `1` = Standard `1012` = OWASP Top 10 Application Security Risks 2013 `1024` = SANS Top 25 2011 `1025` = OWASP Top 10 2017 `1027` = General Data Protection Regulation (GDPR) `1034` = DISA-STIGV4R9 `1036` = DISA-STIGV4R10 `1037` = CWE Top 25 `1041` = OWASP Application Security Verification Standard (ASVS) `1043` = DISA-STIGV4R11 `1044` = API `1045` = DISA-STIGV5R1 `1046` = NIST-SP80053R5 `1047` = CWE Top 25 2020 `1048` = CWE Top 25 2021 `1049` = OWASP Top 10 2021 By Type `3` = SOAP `7` = Blank `1001` = SQL Injection `1002` = Cross-Site Scripting `1005` = Passive `1008` = Critical and High Vulnerabilities `1010` = Aggressive SQL Injection `1011` = NoSQL and Node.js `1013` = Mobile `1015` = Apache Struts `1016` = Transport Layer Security `1020` = Privilege Escalation `1021` = Server-side `1022` = Client-side `1026` = DISA-STIG-V4R4 `1029` = DISA-STIG-V4R5 `1030` = DISA-STIG-V4R6 `1031` = DISA-STIG-V4R7 `1032` = DISA-STIGV4R8 `1033` = WebSocket `1035` = PCI Software Security Framework 1.0 (PCI SSF 1.0) `1050` = OAST `1051` = Aggressive Log4Shell Deprecated `2` = Assault (Deprecated) `4` = Quick (Deprecated) `5` = Safe (Deprecated) `6` = Development (Deprecated) `16` = QA (Deprecated) `17` = Application (Deprecated) `18` = Platform (Deprecated) `1009` = OWASP Top 10 Application Security Risks 2010 (Deprecated) `1014` = OpenSSL Heartbleed (Deprecated) `1018` = Standard (Deprecated) `1019` = Deprecated Checks Hazardous `1004` = All Checks
	`-pc {policy path}`	Specifies a custom policy to use. For path, specify the full path and file name, such as: `C:\ProgramData\hp\HP WebInspect\MyCustomPolicy. policy`
Authentication	`-ab "userid:pwd"`	Specifies Basic mode (user name and password).
	`-ac "userid:pwd"`	Specifies ADFS CBT mode (user name and password).
	`-an "userid:pwd"`	Specifies NTLM mode (user name and password).
	`-ad "userid:pwd"`	Specifies Digest mode (user name and password).
	`-aa "userid:pwd"`	Specifies Automatic mode (user name and password).
	`-ak "userid:pwd"`	Specifies Kerberos mode (user name and password).
	`-am {macro path}`	Deprecated; use the `-macro` option.
	`-at "{type} {token}"`	Specifies the authentication mode (type and token) for API scans, such as: `-at "Basic YWxh0GRpbjpvcGVuc2VzYW1l"` Authentication modes for `type` are as follows: `Basic Bearer Digest HOBA Mutual Negotiate OAuth SCRAM-SHA-1 SCRAM-SHA-256 vapid` Note: The type and token must be enclosed in double quotation marks as shown previously.
Macro	`-macro {macro path}`	Specifies macro name and directory path for web macro authentication.
	`-macro {url} {username} {password}`	Creates auto-generated macro for authentication.
Login Macro Parameters	`-ls "userid:pwd"`	Replaces the SmartCredentials UserName and Password with the supplied values.
	`-lt "``name0:value0;name1:value1; ...nameN:valueN``"`	Replaces existing TruClient login parameters that match the specified names.
Output	`-ea {filepath}`	Exports scan in legacy full XML format.
	`-eb {filepath}`	Exports scan details (Full) in legacy XML format.
	`-ec {filepath}`	Exports scan details (Comments) in legacy XML format.
	`-ed {filepath}`	Exports scan details (Hidden Fields) in legacy XML format.
	`-ee {filepath}`	Exports scan details (Script) in legacy XML format.
	`-ef {filepath}`	Exports scan details (Set Cookies) in legacy XML format.
	`-eg {filepath}`	Exports scan details (Web Forms) in legacy XML format.
	`-eh {filepath}`	Exports scan details (URLs) in legacy XML format.
	`-ei {filepath}`	Exports scan details (Requests) in legacy XML format.
	`-ej {filepath}`	Exports scan details (Sessions) in legacy XML format.
	`-ek {filepath}`	Exports scan details (E-mails) in legacy XML format.
	`-el {filepath}`	Exports scan details (Parameters) in legacy XML format.
	`-em {folderpath}`	Exports scan details (Web Dump) in legacy XML format.
	`-en {filepath}`	Exports scan details (Offsite Links) in legacy XML format.
	`-eo {filepath}`	Exports scan details (Vulnerabilities) in legacy XML format.
	`-ep {filepath}`	Exports scan in FPR format to specified file.
	`-eq {format} {filepath}`	Exports scan details from the Site Tree. The details include: Date and time (in milliseconds) the request was sent Host Path Method Status code Elapsed time (in milliseconds) between the request and the response For single-page application (SPA) scans: The CSV format includes SPADisplayName and SPASelector columns. The JSON format includes SPA Events which contain SPADisplayName and SPASelector data. For more information, see SPA Coverage. Values for format are: `json` `csv` If a value being exported includes double quotation marks, escape characters (double quotation marks) will be added to the CSV output. For example, the selector "Sign in" includes double quotation marks, so it will appear as follows in the CSV file: `"//a[normalize-space(string(.))=""Sign in""]"` Tip: Use this option in conjunction with the `-ie`, `-ir`, `-ix`, or any of the start scan options to identify the scan for which you want to retrieve data. For example: `-ix {scan GUID} -eq {format} {filepath}`
	`-es {filepath}`	Exports scan in `.scan` format to specified file.
	`-et {filepath}`	Exports scan with logs in `.scan` format to specified file.
	`-eu {filepath}`	Exports scan settings to specified file after applying all other overrides. Note: This parameter does not run the scan. It exports the settings and exits.
Reports	`- r {report_name}` For multiple reports, separate report names with a semicolon. All reports will be contained in a single file.	Identifies the name of the report to run. Valid values for report_name are: `Aggregate` `Alert View` `Attack Status` `Compliance` `Crawled URLs` `Developer Reference` `Duplicates` `Executive Summary` `False Positive` `QA Summary` `Scan Difference` `Scan Log` `Trend` `Vulnerability` `Vulnerability (Legacy)` Note: Report names containing a space must be enclosed in quotation marks.
	`-w {favorite_name}`	Identifies the name of the report favorite to run.
	`-ag`	Aggregates reports in report favorite.
	`-y {report_type}`	Specifies the type of report: `Standard` or `Custom`.
	`-f {export_file}`	Specifies the file path and file name where the report will be saved.
	`-gp`	Exports as Portable Document Format (PDF) file.
	`-gh`	Exports as HTML file.
	`-ga`	Exports as raw report file.
	`-gc`	Exports as rich text format (RTF) file.
	`-gx`	Exports as text file.
	`-ge`	Exports as Excel file.
	`-t {filepath}`	Specifies compliance template file to use.
Scan Merge	`-ic {scan id} {scan name}`	Creates a merge target scan. For more information, see Merging Scans in this topic. Note: This parameter is not supported in Fortify WebInspect on Docker.
	`-im /o:{option} {merge target scan id} {source scan id1} {source scan id2}`	Merges scans. For more information, see Merging Scans in this topic. Choices for option are: `Replace` - Replace target session and vulnerabilities with source session and vulnerabilities. `ReplaceMergeVulns` - Replace target session with source session, and add source vulnerabilities to target scan. `Skip` - When session IDs are the same in both scans, do not merge sessions or vulnerabilities. `SkipMergeVulns` - When session IDs are the same in both scans, do not replace target session and copy vulnerabilities from source. `Smart` - Consider source and target policy and times when merging. Important! Use the `-ic` parameter to create the merge target scan before using the `-im` parameter. Note: This parameter is not supported in Fortify WebInspect on Docker.
Scan Reuse	`-iz /o:{option} {source scan id} {settings filename}`	Creates reuse scan settings. Choices for option are: `Incremental` - Use same settings as source scan, with a modified policy that disables checks that flagged in source scan and that should only flag once. This mode audits only new crawl surface. A new crawl is performed, but only new sessions are audited. `Remediation` - Use same settings as source scan, with a modified policy that disables checks that did not flag in source scan. The settings filename is the name of the modified settings file being created. Note: This parameter is not supported in Fortify WebInspect on Docker.
Scan Findings Retest	`-iv <guid> {[<severity> \| <vuln ID prefix>] ...} /s <file path>`	Creates a settings file that you can use to start a scan to retest findings. You can retest findings by severity or unique sessionCheckFoundID or both. If you do not provide a severity or sessionCheckFoundID, then all findings in the base scan are retested. Parameter components are as follows: `<guid>` is the base scan ID. This is required. `<severity>` is the vulnerability severity or severities to retest. All vulnerabilities from the base scan that were flagged with the listed severity or severities will be retested. Options for severity are: `Critical`, `High`, `Medium`, `Low`. `<vuln ID prefix>` is the unique sessionCheckFoundID, which can be retrieved by way of the SessionCheckFounds API endpoint. For more information, see the Fortify WebInspect REST API Swagger UI. Tip: You can specify a prefix of the sessionCheckFoundID. For example, `012f` would match sessionCheckFoundID `012fa34124`. `/s <file path>` is the directory path and file name for the vulnerability retest settings file that will be created. This parameter is required, and modifies the settings from the original scan to specify a retest. The new settings file that is created identifies the vulnerability or vulnerabilities being retested. You can provide a list consisting of severities and sessionCheckFoundIDs in any order. The following example shows a valid list: `Critical 3156 High 1234`
Test Login Macro	`-it {scan id}`	Tests login macro of existing scan.
Selenium Macro	`-selenium_workflow {ArrayOfSelenium Command object}`	Creates a Selenium workflow scan. For the complete process and procedures involved in using this command, see Integrating with Selenium WebDriver.
	`-selenium_no_ validation`	Disables validation of Selenium commands before running the scan. Important! When using this parameter, you must specify one or more allowed hosts. For more information, see Integrating with Selenium WebDriver.
	`-slm {SeleniumCommand object}` or `@"PathtoFilewithobject"`	Specifies a Selenium login macro for the scan. This option uses the `ArrayOfSeleniumCommand object` with one element or the `SeleniumCommand object`. Use `@"PathtoFilewithobject"` to specify the path to a file that includes the `SeleniumCommand object` or `ArrayOfSeleniumCommand object`. See Selenium Login Macro Example. Important! A `LogoutCondition` element is required.
Postman Scans	`-pwc {filename}`	Starts a scan with a Postman Collection file. This option can accept several collection files separated by commas, such as: `-pwc pcOne,pcTwo,pcThree` For more information, see Scanning with a Postman Collection.
	`-pdac`	Disables Postman auto-configuration so that auto-configuration or analysis of the Postman collection is not performed before the scan.
	`-plc {Collection path}`	Specifies the path to the Postman login collection.
	`-pls "logoutsignature"`	Identifies the logout condition. This parameter accepts Regex Extensions. Important! You must replace the space character with `\s`.
	`-pec {filename}`	Specifies the Postman environment file to be used in the scan.
State Management	`-rs {<ArrayOfResponse StateElement>} or "@{file path}"`	Supplies a response state rule. This parameter accepts an `ArrayOfResponseStateElement` element or a response state rule stored in a file. It is used for Bearer token and API Key. Important! To use a response state rule stored in a file, you must specify the file path with the `@` symbol. For examples, see Response State Rule Example.
Other Settings	`-ah {url} [,{url},...]`	Lists the Allowed Hosts. The `URL` is the schema, host, and port number.

Examples

The following examples illustrate command line execution as if executed from the WebInspect home directory:

wi.exe -u www.anywebsite.com -ps 1 -ab MyUsername:Mypassword

wi.exe -u https://zero.webappsecurity.com       
       -s c:\program files\webinspect\scans\scripted\       
       -r "Executive Summary";Vulnerability -y Standard       
       -f c:\program files\webinspect\scans\scripted\zero051105.xml -gx

If you do not specify a policy, Fortify WebInspect will crawl (but not audit) the Web site.

If you specify an invalid policy number, Fortify WebInspect will not conduct the scan.

Selenium Login Macro Example

The following is an example of the Selenium login macro option:

-slm "<SeleniumCommand><Command>"wi command\"</Command>
<AllowedHosts><string>http://hostname/</string>
</AllowedHosts><LogoutCondition>Access\sDenied</LogoutCondition>
</SeleniumCommand>"

Response State Rule Example

The following is an example of a response state rule:

-rs "<ArrayOfResponseStateElement><ResponseStateElement><name>
AutoDetect</name><ReplaceRegexes><string>Authorization:\sBearer\s
(?&lt;AutoDetect&gt;[^\r\n]*)\r\n</string></ReplaceRegexes>
<SearchRegexes><string>""en"":""(?&lt;AutoDetect&gt;
[-a-zA-Z0-9._~+/]+?=*)""}$</string></SearchRegexes>
</ResponseStateElement></ArrayOfResponseStateElement>"

Tip: You can create response state rules in Scan Settings: HTTP Parsing in the Fortify WebInspect user interface. You can then open the scan settings XML file, locate the ResponseStateElement, and copy and paste it into the -rs parameter. For more information about response state rules, see Scan Settings: HTTP Parsing.

The following code shows an example starting a Postman scan using a response state rule that is stored in a file:

wi -pwc c:\BearerWorkflow.json -pdac -plc c:\BearerLogin.json 
-rs @c:\BearerResponseStateRule.txt -pls

Merging Scans

Note: This feature is not supported in Fortify WebInspect on Docker.

You cannot merge into an existing scan. You must first create a merge target using the "ic" parameter.

The scans to be merged are sorted by scan date and are merged in that order. Order is important because information is lost when session IDs are the same in the two scans. When this occurs, by default the earlier session and vulnerability are overwritten with the later session and vulnerability. To prevent this when merging, you can choose another option for handling identical session IDs.

Note: Merging may work best with two scans that have few or no identical session IDs.

For all merge scan options, only sessions with an audit status of “Complete” in the source scan are merged. Session Exclusions (excluded from audit) are not merged. See Audit Settings: Attack Exclusions for more information.

Hyphens in Command Line Arguments

You can use hyphens in command line arguments (output files, etc.) only if the argument is enclosed in double quotes, as illustrated by the "export path" argument in the following command:

wi.exe -u http://zero.webappsecurity.com -ea "c:\temp\command-line-test-export.xml"

Note: The process, as it appears in the Task Manager, is WI.exe. Scan data will be cached temporarily in the Working directory and then moved to the Scans directory.

Exit Codes

The WI.exe application returns one of the exit codes described in the following table.

Code	Description
0	The command completed without errors.
-1 or -3	An error occurred.