MValenti193853 (Community Member) asked a question.
DAST scanner to avoid locking out authenticated scans
Is there a way to stop the DAST scanner scanning on the login page? I know blocklist exists, but if the login url directory is also referenced in the site down the line, it would get blocked so you can't scan that part of the web app (I.E. login url mysite/feature and there is a subdirectory of mysite/feature also once logged in that has more directories)
.png){kind=logo}
Hello @MValenti193853 (Community Member),
Checking with our Dynamic Engineers, they stated that in order to accomplish what is being requested, a support case would need to be opened. When opening the support case, please provide the URL of the page that needs to be ignored in order for the Dynamic Engineer to complete the task.
Here's how you can log a case:
Jason
Veracode Support Engineer
Hello,
MValenti193853 raises a valid concern about DAST scanners potentially blocking out authenticated scans due to login page inclusion. Here are some approaches to address this.
If you're using Veracode Static Analysis alongside DAST, integrate them. This allows passing login credentials securely to DAST, enabling it to scan beyond the login page while maintaining security.
Veracode DAST might offer configuration options to handle session management. You can potentially specify the cookie or token name used for authentication, allowing the scanner to maintain a logged-in session while crawling the application.
DAST Scanner Configuration (if available): Some DAST scanners allow excluding specific URLs or URL patterns from scanning. You could define a pattern that matches the login page URL (e.g., /login*) to prevent the scanner from targeting it directly.
If your application has a well-defined API, consider using Veracode API Scanning instead of DAST. This approach focuses on functionalities exposed through the API, potentially eliminating the need to bypass the login page altogether.
Best Regards,
Maxim Time Clock