Automation Scripts
You can upload your existing automation scripts to FortiDAST. Once uploaded, these scripts are replayed in a controlled environment, providing several benefits:
-
Improve data collection for authentication, crawling, and fuzzing of web applications.
-
Discover hard-to-find URLs through efficient web crawling.
-
Replay core business logic to identify vulnerabilities.
Adding an automation script
|
Before uploading to FortiDAST ensure the script requirements are met. Also, the automation script must be configured with target URL, UUID, and FortiDAST API key. See Automation Script Prerequisites You can also click FAQs in the GUI to learn more about script configuration. |
-
Navigate to Configure > Replay with Automation.
-
Select the Automation Scripts tab.
-
Click + Create.
-
Enter a unique name for the script. This must match with script_name parameter configured in the script.
-
Browse and upload the script file.
-
Enable Run script on every scan toggle to execute the uploaded script with each scan.
-
Click OK to save the script.
Script validation
The Validation Status indicates the script's current validation state.
-
New: Script uploaded but not yet validated.
-
In Progress: Script validation is ongoing.
-
Successful: Script is validated and ready for use.
-
Failed: Script validation failed. CheckValidation Errors for details.
The status of scripts validation can also be viewed on the Scans Policy page. A gear icon is displayed when scripts are added. Hover on the icon to view the count of scripts In Progress, Success or Failed.
Session logging
Session logging captures cookies and other session details during script execution. To enable session logging, select a script and click Select for session logging. Confirm your selection in the popup window.
Viewing script details
Select a script and click Show Details. This displays the script details and validation results. You can also download the script execution output, containing traversed URLs and APIs.
Deleting a script
Select a script you want to delete and click Delete.
|
|
During rescan, the output from initial script validation and execution is used. |