Issue
A target application is unable to handle the performance load generated by a scan, resulting in problems such as:
cpu throttling of the host running the application
memory depletion of the host running the application
slow response times
this can manifest as false positives for alerts that are based on timing-based attacks; for instance:
rate-limiting by the application
this can manifest as a high rate of HTTP
429 Too Many Requestserrors, which some alerts can interpret as evidence of a vulnerability
Solution
In order to alleviate performance load on the application, HawkScan can be tuned to:
send fewer requests in parallel
inject a wait time between requests
How? By configuring the concurrentRequests and requestDelayMillis parameters in hawk.scan in your stackhawk.yml file.
By default (i.e., when you don't specify them in the yml file), these parameters are:
concurrentRequests: 20(20 concurrent requests to the application)requestDelayMillis: 0(0 millisecond delay between requests)
To tune them, lower the concurrentRequests value below 20, and/or add a non-zero delay to requestDelayMill.
For example:
hawk:
scan:
concurrentRequests: 10
requestDelayMillis: 5
Tune this value incrementally between scans and compare the scan results, if possible, to the system and application logging generated by the target application.