Question:
Why do I see unexpected URL’s in the Paths tab under Scan Details for a particular scan?
That is, as compared to:
URL's on the site that a web spider should find
URL's contained in the API configuration (OpenAPI spec or GraphQL schema) configured for the application in stackhawk.yml
For example, for a particular API endpoint (/id), multiple variants show up in the Paths tab:
https://app1234.example.com/id/complete?query%5B%24queryone%5D=
https://app1234.example.com/id/complete?query%5B%24querytwo%5D=.*
Answer:
The Paths tab represents a full listing of all URL's that HawkScan found and tested in various ways throughout the scanning process.
In other words, the URL's in the Path sections are not simply the list of base path URL's that HawkScan's spider found on the site and those that are contained in an OpenAPI configuration supplied to the scanner.
Factors that result in URL's appearing in the Paths tab:
URL's found by the HawkScan's web spider (the default basic spider or the optional ajax spider)
API paths supplied by a configured OpenAPI spec (or GraphQL schema)
The number of tests that HawkScan runs during the scanning process
this is influenced by the Technology Flags configuration
for instance, various versions of SQL Injection when multiple database types are configured
In most cases, no specific action is required if additional / unexpected URL's appear in the Paths tab, other than reviewing the specific scan results as usual and tuning the Technology Flags configuration to test only the relevant technologies present in your application.
Additional Information:
Missing URL's:
If instead you're not seeing all the URL's expected (e.g., API paths are missing), investigate whether the scanner is getting properly authenticated to the API during the scanning process.
See Authenticated Scanning or launch the Setup Authenticated Scanning wizard (Org-->Applications-->Dropdown Menu on a specific application) for more details.
GraphQL:
When generating a GraphQL schema, see HawkScan fails with 500 Internal Error when attempting to scan a GraphQL application via filePath to avoid schema parsing issues.