Glass Box view

Use this glass box agent

If the glass box agent has been installed on your application server, and defined in AppScan, you can select it for use in the scan. If you have entered a Starting URL, AppScan attempts to select the appropriate agent automatically.

Use glass box in the Explore stage

(Selected by default.)

This function can increase coverage of the site, by examining the server-side source code for the presence of parameters that affect the behavior of the server, but do not appear in the response.

String debugOn = request.getParameter("debug");
if (debugOn == "true"){
	response.getWriter().println(SECRET_SERVER_DATA);
}

Use glass box in the Test stage

(Selected by default.) Select this check box to send glass box tests during the Test stage of the scan. This function can verify the success or failure of certain tests, such as Blind SQL Injection, with greater accuracy, and also reveal the existence of certain security issues that cannot be detected by black box techniques.

Skip equivalent black box tests

(Cleared by default.) This means that both glass box tests and black box tests for the same vulnerability (WASC Threat Classification) are sent. This is because although the glass box tests are generally both more accurate and give more detailed results, occasionally a glass box test may fail while the equivalent black box test succeeds. If the results for your application are unchanged when black box tests are skipped, you can reduce scan time by selecting this check box.