Server down check
It would be very good to have some sort of keep-alive functionality to ping server whether it is still up, and depending on the pre-set response by user (e.g. custom error message), it would pause Active scanning until the ping is a success, or user starts it again after making sure the environment is working.
On a "volatile" environment, the Active scanner scans until it is finished, ignoring the state of the server (if some specific error page is set to all requests).
I know that as a part of session management session checking can be done, I'm not aware of a possibility to stop/pause active scanner in case of server-side issues (ideally a user pre-defined).
Thanks for this suggestion. We’re planning to provide more capabilities in terms of fully automated crawl-and-scan, and as part of this we will consider ways that we can suspend / throttle the scan in situations where the target application is volatile.
In the mean time - is there some API or way to create Extender, which would have the power to pause the Active scan? If not, could something be added in future to be able to control active scanner state via extenders?
There isn’t currently an API to pause/unpause the Scanner, sorry. We are planning a general revamp of the API and we will look into providing this.
In the meantime, a nasty hack to implement your own pause function would be to use an IHttpListener to hook all requests made by the Scanner, and wait each thread on your own lock object when you want the Scanner to be paused.