Application settings: General

Enable Active Content in Browser Views

Select this option to allow execution of JavaScript and other dynamic content in all browser windows within OpenText DAST.

For example, one OpenText DAST attack tests for cross-site scripting by attempting to embed a script in a dynamically generated Web page. That script instructs the server to display an alert containing the number "76712." If active content is enabled and if the attack is successful (i.e., cross-site scripting is possible), then selecting the vulnerable session and clicking on Web Browser in the Session Info panel will execute the script and display the following:

Enable Diagnostic File Creation

If the OpenText DAST application should ever fail, this option forces OpenText DAST to create a file containing data that was stored in main memory at the time of failure. You can then provide the file to OpenText support personnel.

If you select this option, you may also specify how many diagnostic files should be retained. When the number of files exceeds this limit, the oldest file will be deleted.

Reset "Don't Show Me Again" messages

Use Seven Pernicious Kingdom (7PK) Taxonomy

This option enables you to select The Seven Pernicious Kingdoms taxonomy for ordering and organizing the reported vulnerabilities.

Seven Pernicious Kingdoms (7PK) is a taxonomy of software security errors developed by the OpenText Software Security Research Group together with Dr. Gary McGraw. Each vulnerability category is accompanied by a detailed description of the issue with references to original sources and code excerpts, where applicable, to better illustrate the problem.

The organization of the classification scheme is described with the help of terminology borrowed from biology: vulnerability categories are referred to as phyla, while collections of vulnerability categories that share the same theme are referred to as kingdoms. Vulnerability phyla are classified into pernicious kingdoms presented in the order of importance to software security.

The seven kingdoms are:

1. Input Validation and Representation

2. API Abuse

3. Security Features

4. Time and State

5. Errors

6. Code Quality

7. Encapsulation

   * Environment

The first seven kingdoms are associated with security defects in source code, while the last one describes security issues outside the actual code.

The primary goal of defining this taxonomy is to organize sets of security rules that can be used to help software developers understand the kinds of errors that have an impact on security. By better understanding how systems fail, developers will better analyze the systems they create, more readily identify and address security problems when they see them, and generally avoid repeating the same mistakes in the future. For more information, see https://vulncat.fortify.com/.

You might want to use the Seven Pernicious Kingdoms taxonomy if you are integrating OpenText DAST with other OpenText Fortify products as it provides for a unified taxonomy.

By default, OpenText DAST uses this option. The OpenSSL engine provides support for websites that require use of the TLS 1.3 security protocol. OpenSSL is backwards compatible with previous versions of the TLS protocol.

If this option is enabled, the SSL/TLS Protocols options are disabled in Scan settings: Method. You cannot select individual protocols for a scan.

Use this option if your website supports the HTTP/2 protocol only and you experience issues using the HTTP/1 protocol.

Composite settings consist of a JSON version of the scan settings packaged in a ZIP file with any binary files required for the scan, such as macros, client certificates, custom policies, and so forth. OpenText ScanCentral DAST uses composite settings. By default, OpenText DAST uses XML settings. Selecting this option enables OpenText DAST to create and use composite settings that are ready to import and use in OpenText ScanCentral DAST without conversion.

You cannot convert XML settings into composite settings in the OpenText DAST UI. You must use the OpenText DAST API endpoint configuration/scansettings/convert or import the settings into OpenText ScanCentral DAST for automatic conversion. Additionally, when saving a settings file from a scan that was conducted using XML settings, the file is saved in the XML format even if the Use Composite Scan Settings option is enabled.

Use WebInspect Agent information when encountered on target site

If this option is selected and OpenText DAST detects that OpenText DAST Agent is installed on a target server, it will incorporate OpenText DAST Agent information to improve overall scan efficiency.

A notation on the OpenText DAST dashboard indicates whether or not OpenText DAST Agent has been detected.

Automatically group by duplicate vulnerabilities in vulnerability window

Allow WebInspect Agent to suggest attack strategy