Configure Active Verification

Define how to apply Active Verification to the requests generated by an application.

The accuracy of vulnerability detection is empowered by the Seeker's Active Verification mechanism.

For background information, see About Active Verification.

  1. In the main menu, click (Projects) and open a project that you want to configure..
  2. Click Features.
  3. Toggle the Enabled switch for Active Verification on.
  4. Click Configure, and toggle Enable Active Verification for requests that perform data change operations.
    If enabled, Active Verification would sends HTTP requests that potentially involve data change operations, such as adding database records.
  5. Save your changes.
  6. To enable or disable Active Verification for some parts of your application, click Configure exclusion rules.
  7. Click Add exclusion rule to create a new rule or Edit for an existing one. In the Create/edit exclusion rule page that opens, enter the following:
    OptionDescription
    What to exclude From the dropdown list, choose Full requests or Parameters.
    Request path pattern Enter a pattern that the excluded request paths of your application should match, such as */cart/*.
    Parameter/Header name pattern Exclude requests containing specific parameters or headers. Enter a pattern that parameter or header names should match, such as Authorization or *token*.
    Note: You can use an asterisk (*) as a wild card in a pattern. For example: com.mycompany.testapp.*.

    Save your changes.

    As a result, no verification requests will be sent to your application for the excluded requests and/or parameters.

Automation with APIs

You can automate some of these tasks by using Seeker APIs. For the detailed API reference, click (Web API) in the main menu.

/api/{ver}/projects/{key}/settings/features/activeverification PUT
Enables or disables Active Verification for a project.