Manual exploring
This section deals with ways in which you can manually explore your application or services before starting the Test stage of the scan, or before starting an automatic scan (that includes both automatic Explore and Test stages).
Manual exploring is when you explore your site to gather data that can be used by AppScan to ensure that when it tests the site it covers parts of the application or services that it might have missed with its automatic Explore stage. This may be because specific user input is required, or because the site responds only to a different type of tool or device. You can manually explore using AppScan, or using it as a recording proxy, or using Generic Service Client (GSC).
In general:
- AppScan
- is used for manual exploring when the site does not include services. Your actions and input are recorded and used by AppScan in creating tests for the Test stage of the scan.
- AppScan as recording proxy
- is used when you want to explore manually using your own remote device (such as a mobile phone) or external application (such as a mobile simulator or emulator), with AppScan configured as recording proxy. Use cases may include SOAP web services, or non-SOAP services that do not include a security envelope, or applications that require a different browser. Requests are sent to the site from an external device or application, with AppScan configured as recording proxy. This enables AppScan to record the responses and use them to create tests for the Test stage of the scan.
- Generic Service Client (GSC)
- is used for exploring web services that have a WSDL file. GSC creates a simple interface for sending requests to the service, and the responses are imported into Appscan and used in creating tests for the Test stage of the scan.