troubleshooting.md

stage: Secure
group: Dynamic Analysis
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
type: reference, howto

Troubleshooting

The following troubleshooting scenarios have been collected from customer support cases. If you experience a problem not addressed here, or the information here does not fix your problem, create a support ticket. For more details, see the GitLab Support page.

When something goes wrong

When something goes wrong with a DAST scan, if you have a particular error message then check known problems.

Otherwise, try to discover the problem by answering the following questions:

• What is the expected outcome?
• Is the outcome achievable by a human?
• Any reason why DAST would not work?
• How does your application work?
• What is DAST doing?

What is the expected outcome?

Many users who encounter issues with a DAST scan have a good high-level idea of what they think the scanner should be doing. For example, it's not scanning particular pages, or it's not selecting a button on the page.

As much as possible, try to isolate the problem to help narrow the search for a solution. For example, take the situation where DAST isn't scanning a particular page. From where should DAST have found the page? What path did it take to navigate there? Were there elements on the referring page that DAST should have selected, but did not?

Is the outcome achievable by a human?

DAST cannot scan an application if a human cannot manually traverse the application.

Knowing the outcome you expect, try to replicate it manually using a browser on your machine. For example:

• Open a new incognito/private browser window.
• Open Developer Tools. Keep an eye on the console for error messages.
  • In Chrome: View -> Developer -> Developer Tools.
  • In Firefox: Tools -> Browser Tools -> Web Developer Tools.
• If authenticating:
  • Navigate to the DAST_AUTH_URL.
  • Type in the DAST_USERNAME in the DAST_USERNAME_FIELD.
  • Type in the DAST_PASSWORD in the DAST_PASSWORD_FIELD.
  • Select the DAST_SUBMIT_FIELD.
• Select links and fill in forms. Navigate to the pages that aren't scanning correctly.
• Observe how your application behaves. Notice if there is anything that might cause problems for an automated scanner.

Any reason why DAST would not work?

DAST cannot scan correctly when:

• There is a CAPTCHA. Turn these off in the testing environment for the application being scanned.
• It does not have access to the target application. Ensure the GitLab Runner can access the application using the URLs used in the DAST configuration.

How does your application work?

Understanding how your application works is vital to figuring out why a DAST scan isn't working. For example, the following situations may require additional configuration settings.

• Is there a popup modal that hides elements?
• Does a loaded page change dramatically after a certain period of time?
• Is the application especially slow or fast to load?
• Is the target application jerky while loading?
• Does the application work differently based on the client's location?
• Is the application a single-page application?
• Does the application submit HTML forms, or does it use JavaScript and AJAX?
• Does the application use websockets?
• Does the application use a specific web framework?
• Does selecting buttons run JavaScript before continuing the form submit? Is it fast, slow?
• Is it possible DAST could be selecting or searching for elements before either the element or page is ready?

What is DAST doing?

Logging remains the best way to understand what DAST is doing:

• Browser-based analyzer logging, useful for understanding what the analyzer is doing.
• Chromium DevTools logging, useful to inspect the communication between DAST and Chromium.
• Chromium Logs, useful for logging errors when Chromium crashes unexpectedly.

Browser-based analyzer logging

The analyzer log is one of the most useful tools to help diagnose problems with a scan. Different parts of the analyzer can be logged at different levels.

Log message format

Log messages have the format [time] [log level] [log module] [message] [additional properties].

For example, the following log entry has level INFO, is part of the CRAWL log module, has the message Crawled path and the additional properties nav_id and path.

2021-04-21T00:34:04.000 INF CRAWL Crawled path nav_id=0cc7fd path="LoadURL [https://my.site.com:8090]"

Log destination