List Driven Scan Issue

[Learner_7]

Hi

I tried to do a list driven scan. When a list driven scan is done, we still get the options of crawl, crawl+audit, manual. 

My doubt is if I am providing the list of URL, what difference will it make if I select crawl option ?

Also, a list driven scan does not have option of restricting a scan to directory. So is the crawl also restricting to those URLs that are in the list?

[k1DBLITZ]

My doubt is if I am providing the list of URL, what difference will it make if I select crawl option ?

If you select the crawl option, the crawler will attempt to find and follow links on its own in addition to the URL's you have specified. 

So is the crawl also restricting to those URLs that are in the list?

Yes, if you select "Audit Only" as the type of scan.

[HansEnders]

As k1DBLITZ indicated, the List may be used to force-feed known pages to the Crawler, which then proceeds with its normal Discovery phase.  Or you can use the List to limit the entire scan to only Auditing those pages in your List, omitting the Discovery phase.

Sadly, the List is limited to GET queries, since it only lists URLs and does not provide POST parameters.  But you can build the List using any combination of crawler or listing tool, so long as you format the input file for WebInspect appropriately.

An alternative to the List-Driven scan is a Workflow-driven scan, where you have pre-recorded sessions (GETS as well as POSTs).  You can import more than one recording into the (Guided) Scan Wizard, and the recordings could have been captured with our Workflow Macro Recorder tool, the included Web Proxy tool, or even BURP.  If you are a HP UFT user, those scripts can also be used, but require the UFT client be co-installed with WebInspect.