This article applies to:

• App Scanner 8.5 and greater

Question:

• What is the injection series time limit?

Information:

Terms:

• SmartAttack – a set of rules that can act as an exploit, test Application logic, or check for compliance to internal or regulatory standards. 
• Injection Series – Group of requests with different injection values testing one unique URL.

Background:

Some SmartAttacks can take a large amount of time to complete for individual traversal requests. 

The following will affect how long a SmartAttack takes to complete:

• Number of injectable items in each traversal request
• Responsiveness of the target application
• The 'Attack Throttling' settings on the application settings

When one assessment takes a large amount of time to complete, it will tie up resources for the duration of the scan. This can result in the stage timing out before the SmartAttacks have completed, or scans which run for the maximum of 4 days and never complete.

When the Injection Series time limit is reached, the scan shows an 'issue' as in the image below. (The time limit was set to 1 minute for demonstration purposes.)

Solution:

To prevent one SmartAttack from taking too long during injections, App Scanner 8.5 introduced a time limit on the individual Injection Series. If an individual Injection Series exceeds the maximum allowed time, the series is aborted. Any remaining items to be injected or untested injection values are skipped for the series. This feature allows administrators to evaluate why the time limit was reached for a particular request, and adjust future tests.

For most assessments, the time limit should not be a problem. For large assessments or assessments where a page has a large number of injectable items, the time limit may be reached.

Configuration:

The default allowed time for a single injection series is 30 minutes. This can be changed globally for all applications or on a per application basis. The value is set as an integer in minutes. A value of 0 (zero) does not apply any time limit on an injection series.

Global Setting

To change the injection series timeout, edit the following Mozilla preference: cenzic.policyengine.injectionSeriesTimeLimitMinutes

1. In the Administration menu, browse to the Mozilla Preferences 
   
   
   |
2. Add the Mozilla preference cenzic.policyengine.injectionSeriesTimeLimitMinutes. Select the Preference Type to Int using the menu, and enter the time in minutes to allow before the series times out.
   
   
3. You should see the preference added to the table.
   
   

Per Application Setting

1. Browse to the application for which you want to change the setting.
2. Click Settings.
   
   
3. Expand the Advanced Settings section.
   
   
4. Under Custom Settings, click Add.
   
   
5. Enter the Key injectionSeriesTimeLimitMinutes and the value in minutes for the time limit. Click OK.
   
   
6. The custom setting should now display in the table. To save changes, click Update at the bottom of the page.