"<wvs_profile_name>"

Type a unique name for the profile name. The maximum length is 63 characters.

scan-target <scan-target_str>

Enter the URL that you want to scan, such as www.mytestwvs.com.

scan-template <scan-template_id>

Select an existing scan template that you want to use in the profile.

request-timeout <request-timeout_int>

Type the number of seconds for the vulnerability scanner to wait for a response from the website before it assumes that the request will not successfully complete, and continues with the next request in the scan. It will not retry timeout requests.

ignore-session-cookies {enable | disable}

If enabled, the scanner will ignore all session cookies sent by the target web application.

user-agent-type {custom | random}

Custom: when there is no user-agent in custom headers, the actual user-agent sent is FortiWeb WVS; when user-agent is set in custom headers, the actual user-agent sent is the value set in custom-user-agent <custom-user-agent_str>.
random: When the user-agent-type is random, and there is no user-agent in custom headers, the actual user-agent sent is random; when user-agent is set in custom headers, the actual user-agent sent is random.

custom-user-agent <custom-user-agent_str>

Enter the custom user-agent value.

custom-header0 <custom-header0_str>

You can define the host, user agent, and other common headers in the request.

custom-header1 <custom-header1_str>

You can define the host, user agent, and other common headers in the request.

custom-header2 <custom-header2_str>

You can define the host, user agent, and other common headers in the request.

custom-header3 <custom-header3_str>

You can define the host, user agent, and other common headers in the request.

custom-header4 <custom-header4_str>

You can define the host, user agent, and other common headers in the request.

custom-header5 <custom-header5_str>

You can define the host, user agent, and other common headers in the request.

custom-header6 <custom-header6_str>

You can define the host, user agent, and other common headers in the request.

custom-header7 <custom-header7_str>

You can define the host, user agent, and other common headers in the request.

custom-header8 <custom-header8_str>

You can define the host, user agent, and other common headers in the request.

custom-header9 <custom-header9_str>

You can define the host, user agent, and other common headers in the request.

sub-path-limit <sub-path-limit_int>

Enter the maximum number of requests for sub path of each URL.

max-scan-time <max-scan-time_int>

Enter the maximum scanning time.

max-crawl-time <max-crawl-time_int>

Enter the maximum crawling time (minutes).

max-params-limit <max-params-limit_int>

Enter the maximum number of requests for each URL, and parameter set.

max-file-size <max-file-size_int>

Indicate the maximum file size (in bytes) that the scanner will retrieve from the remote server.

max-HTTP-retries <max-HTTP-retries_int>

Indicate the maximum number of retries when requesting an URL. The valid value range is 1–10.

specify-urls-for-scanning {enable | disable}

Enable to specify the URL to be scanned.

follow-regex <follow-regex_int>

follow-regex is .*. When crawling, do not follow links that match this regular expression.

ignore-regex <ignore-regex_int>

An empty string (nothing to be ignored), when crawling, only follow that matches this regular expression. ignore-regex has precedence over follow-regex.

HTTP-basic-authentication {enable | disable}

Enable the HTTP basic authentication.

basic-username <basic-username_str>

Enter the username of the web application.

basic-password <basic-password_str>

Enter the password for the username.

form-based-authentication {enable | disable}

Enable the form based authentication.

form-based-username <form-based-username_str>

The username parameter name, for example, "uname" if the HTML looks like <input type="text" name="uname">...

form-based-password <form-based-password_str>

The password parameter name, for example, "pwd" if the HTML looks like <input type="password" name="pwd">...

form-based-auth-url <form-based-auth-url_str>

Enter the target URL for security auditing, and the URL shall include HTTP or HTTPS tag.

username-field <username-field_str>

Enter the username for using in the authentication process.

password-field <password-field_str>

Enter the password for the username.

cookie-jar-file <cookie-jar-file_str>

Designate a cookie jar file. The cookie jar file must be in mozilla format.

session-check-url <session-check-url_str>

Enter the URL where the packets are sent to.

session-check-str <session-check-url_str>

Enter the string in the response message. If the string can be checked, the authentication succeeds; otherwise, the authentication will be re-launched.