Qualys Web Application Scanning API User Guide

Web Application Scanning API

User Guide

V

ersion 3.18

June 10, 2024

Qualys Web Application Scanning API

Table of Contents

Get Started ...................................................................................................................................... 6

Web Application Scanning API .................................................................................................. 6

Qualys user account .................................................................................................................... 7

Making API Calls ....................................................................................................................... 8

URL to Qualys API server ........................................................................................................ 12

Tracking API usage by user ...................................................................................................... 13

How to Download Vulnerability Details .................................................................................. 14

Know your portal version ......................................................................................................... 19

JSON Support ........................................................................................................................... 22

YAML Support ......................................................................................................................... 29

Web Applications.......................................................................................................................... 35

Web Application Count ............................................................................................................ 35

Search Web Application ........................................................................................................... 38

Get Web Application Details .................................................................................................... 45

Create Web Application ............................................................................................................ 58

Update Web Application ........................................................................................................... 85

Delete Web Application ............................................................................................................ 94

Purge Web Application ............................................................................................................. 99

Download Selenium Script ..................................................................................................... 103

Reference: WebApp ................................................................................................................ 106

Authentication ............................................................................................................................. 118

Authentication Count .............................................................................................................. 118

Search Authentication Record ................................................................................................ 121

Get Authentication Record Details ......................................................................................... 126

Create Authentication Record ................................................................................................. 135

Update Authentication Record ................................................................................................ 160

Delete Authentication Record ................................................................................................. 167

Reference: Authentication ...................................................................................................... 171

Catalog ........................................................................................................................................ 174

Catalog Entry Count ............................................................................................................... 174

Search for a Catalog Entry ...................................................................................................... 176

Get Catalog Entry Details ....................................................................................................... 180

Qualys Web Application Scanning API

Update Catalog Entry .............................................................................................................. 183

Delete Catalog Entry ............................................................................................................... 185

Update Entries in Catalog ....................................................................................................... 188

Add to Subscription ................................................................................................................ 189

Scans ........................................................................................................................................... 191

Scan Count .............................................................................................................................. 191

Search Scans ........................................................................................................................... 196

Get Scan Details ...................................................................................................................... 207

Launch Scans (Single) ............................................................................................................ 214

Launch Scan (Multiple) .......................................................................................................... 225

Scan Again .............................................................................................................................. 235

Retrieve Scan Status ............................................................................................................... 237

Retrieve Scan Results ............................................................................................................. 239

Cancel Scan ............................................................................................................................. 253

Delete Scan ............................................................................................................................. 255

WasScan Reference ................................................................................................................ 259

WAS Scan Results Reference ................................................................................................. 265

Schedules .................................................................................................................................... 267

Schedule Count ....................................................................................................................... 267

Search Schedule ...................................................................................................................... 272

Get Schedule Details ............................................................................................................... 281

Create a Schedule (single web application) ............................................................................ 285

Create Schedules (Multiple) ................................................................................................... 302

Update Schedule ..................................................................................................................... 317

Activate an Existing Schedule ................................................................................................ 321

Deactivate Schedule ................................................................................................................ 325

Delete Schedule ...................................................................................................................... 329

Download Schedule ................................................................................................................ 332

Reference: Schedule ................................................................................................................ 335

Reference: WasScanSchedule ................................................................................................. 337

Reports ........................................................................................................................................ 346

Report Count ........................................................................................................................... 346

Search Report .......................................................................................................................... 349

Get Report Details ................................................................................................................... 354

Qualys Web Application Scanning API

Get Report Status .................................................................................................................... 356

Download Report .................................................................................................................... 358

Send Encrypted PDF Report ................................................................................................... 359

Update Report ......................................................................................................................... 361

Delete Report .......................................................................................................................... 363

Report Creation ........................................................................................................................... 366

Create Report .......................................................................................................................... 366

Web Application Report ......................................................................................................... 367

Scan Report ............................................................................................................................. 375

Scorecard Report ..................................................................................................................... 385

Catalog Report ........................................................................................................................ 392

Report Template Count ........................................................................................................... 397

Search Report Template .......................................................................................................... 399

Get details of Report Template ............................................................................................... 403

Reference: Report ................................................................................................................... 406

Reference: Report Creation ..................................................................................................... 410

Findings....................................................................................................................................... 416

Finding Count ......................................................................................................................... 416

Search Findings ....................................................................................................................... 421

Get Finding Details ................................................................................................................. 436

Ignore Findings ....................................................................................................................... 447

Activate Findings .................................................................................................................... 455

Edit Finding Severity .............................................................................................................. 460

Restore Findings Severity ....................................................................................................... 464

Retest Findings........................................................................................................................ 468

Retrieve Finding Retest Status ................................................................................................ 471

WAS Findings in XML Report ............................................................................................... 473

Reference: Findings ................................................................................................................ 479

Configuration .............................................................................................................................. 482

Option Profiles ........................................................................................................................ 482

DNS Override ......................................................................................................................... 552

Burp............................................................................................................................................. 574

Import Burp Issues .................................................................................................................. 574

OWASP ZAP .............................................................................................................................. 587

Qualys Web Application Scanning API

Import OWASP ZAP Findings ............................................................................................... 587

Search OWASP ZAP Findings ............................................................................................... 594

Finding OWASP ZAP Count .................................................................................................. 599

Get OWASP ZAP Finding Details ......................................................................................... 602

Error Messages............................................................................................................................ 606

Sample Messages: Elements ................................................................................................... 606

Sample Messages: Authorization ............................................................................................ 610

Sample Messages: Criteria ...................................................................................................... 612

Sample Messages: Report Storage Limit ................................................................................ 613

Available operators ..................................................................................................................... 614

Qualys Web Application Scanning API

Get Started

6

Get Started

Web Application Scanning API

The Web Application Scanning (WAS) API support scanning and reporting on

web applications for security risks.

Modules supported

WAS

Authentication

Authentication to your Qualys account with valid Qualys credentials is

required for making Qualys API requests to the Qualys API servers. Learn

more about authentication to your Qualys account

Get API Notifications

We recommend you join our Community and subscribe to our API

Notifications RSS Feeds for announcements and discussions.

https://community.qualys.com/community/developer/notifications-api

About Qualys

Qualys, Inc. (NASDAQ: QLYS) is a pioneer and leading provider of cloud-

based security and compliance solutions. The Qualys Cloud Platform and its

integrated Cloud Apps deliver businesses critical security intelligence

continuously, enabling them to automate the full spectrum of auditing,

compliance and protection for IT systems and web applications on premises,

on endpoints and elastic clouds. For more information, please visit

www.qualys.com

Qualys and the Qualys logo are proprietary trademarks of Qualys, Inc. All

other products or names may be trademarks of their respective companies

Qualys Web Application Scanning API

Get Started

7

Qualys user account

Authentication to your Qualys account with valid Qualys credentials is

required for making Qualys API requests to the Qualys API servers.

The application must authenticate using Qualys account credentials (user

name and password) as part of the HTTP request. The credentials are

transmitted using the “Basic Authentication Scheme” over HTTPS.

For information, see the “Basic Authentication Scheme” section of RFC #2617:

http://www.faqs.org/rfcs/rfc2617.html

The exact method of implementing authentication will vary according to

which programming language is used.

The allowed methods, POST and/or GET, for each API request are

documented with each API call in this user guide.

Sample request - basic authentication

curl -u "USERNAME:PASSWORD"

https://qualysapi.qualys.com/qps/rest/3.0/count/was/webapp

Qualys Web Application Scanning API

Get Started

8

Making API Calls

Curl samples in our API doc

We use curl in our API documentation to show an example how to form REST

API calls, and it is not meant to be an actual production example of

implementation.

Making Requests with an XML Payload

While it is still possible to create simple API requests using the GET method,

you can create API requests using the POST method with an XML payload to

make an advanced request.

The XML payloads can be compared to a scripting language that allows user

to make multiple actions within one single API request, like adding a

parameter to an object and updating another parameter.

The XML structure of the payload is described in the XSD files.

XML Output Pagination / Truncation

The XML output of a search API request is paginated and the default page

size is 100 object records. The page size can be customized to a value

between 1 and 1,000. If the number of records is greater than the page size

then the <ServiceResponse> element shows the response code SUCCESS with

the element <hasMoreRecords>true</hasMoreRecords> as shown below.

Follow the process below to obtain the first two XML pages for an API

request. Apply the same logic to get all the next (n+1) pages until all records

are returned. This is indicated when

<hasMoreRecords>false</hasMoreRecords>.

Sample 1 - Search web apps

Search for web applications that have a name containing the string

“Merchant”. The service request in the POST data file “file.xml” defines this

search criteria.

API request

curl -u "USERNAME:PASSWORD" -H "content-type: text/xml" -X "POST"

Qualys Web Application Scanning API

Get Started

9

--data-binary @-

"https://qualysapi.qualys.com/qps/rest/3.0/search/was/webapp" <

file.xml

Note: “file.xml” contains the request POST data.

You’ll notice the operator field value is set to 123, which is the value returned

in <lastId> of the previous page output. The GREATER operator is a logical

“greater than” (it does not mean greater than or equal to).

Request POST data

</preferences>

<Criteria field="name" operator="CONTAINS">Merchant</Criteria>

</filters>

</ServiceRequest>

The number of records is greater than the default pagination value so the

<ServiceResponse> element identifies the last ID of the object in the current

page output.

XML response

<responseCode>SUCCESS</responseCode>

<data>

</data>

</ServiceResponse>

Sample 2

To get the next page of results, you need to edit your service request in

“file.xml” that will be passed to API request as a POST payload. According to

the <lastId> element returned in the first page, you want the next page of

results to start with the object ID 124 or greater.

Qualys Web Application Scanning API

Get Started

10

API request

curl -u "USERNAME:PASSWORD" -H "content-type: text/xml" -X "POST"

--data-binary @-

"https://qualysapi.qualys.com/qps/rest/3.0/search/was/webapp" <

file.xml

Note: “file.xml” contains the request POST data.

You’ll notice the operator field value is set to 123, which is the value returned

in <lastId> of the previous page output. The GREATER operator is a logical

“greater than” (it does not mean greater than or equal to).

Request POST data

<Criteria field="name" operator="CONTAINS">Merchant</Criteria>

</filters>

</ServiceRequest>

Setting custom page size

The service request needs to contain the <preferences> section with the

<limitResults> parameter. For the <limitResults> parameter you can enter a

value from 1 to 1,000. You can change which objects are returned and the

number of objects by specifying a preferences tag in the POST body of your

request.

Request POST data

</filters>

</preferences>

</ServiceRequest>

Qualys Web Application Scanning API

Get Started

11

Preferences tag fields:

startFromOffset - The first item to return by index. The default is 1.

startFromId - The first item to return by primary key. No default value.

limitResults - The total number of items to return. The default is 100.

Qualys Web Application Scanning API

Get Started

12

URL to Qualys API server

The Qualys API URL you should use for API requests depends on the Qualys

platform where your account is located.

Click here to identify your Qualys platform and get the API URL

This documentation uses the API server URL for Qualys US Platform 1

(https://qualysapi.qualys.com) in sample API requests. If you’re on another

platform, please replace this URL with the appropriate server URL for your

account.

Looking for your API server URL for your account? You can find this easily.

Just log in to your Qualys account and go to Help > About. You'll see this

information under Security Operations Center (SOC).

Qualys Web Application Scanning API

Get Started

13

Tracking API usage by user

You can track API usage per user without the need to provide user credentials

such as the username and password. Contact Qualys Support to get the X-

Powered-By HTTP header enabled.

Once enabled, the X-Powered-By HTTP header is returned for each API

request made by a user. The X-Powered-By value includes a unique ID

generated for each subscription and a unique ID generated for each user.

Optional X-Powered-By header

API usage can be tracked using the X-Powered-By HTTP header which

includes a unique ID generated for each subscription and a unique ID

generated for each user. Once enabled, the X-Powered-By HTTP header is

returned for each API request made by a user. The X-Powered-By HTTP

header will be returned for both valid and invalid requests. However, it will not

be returned if an invalid URL is hit or when user authentication fails.

The X-Powered-By header is returned in the following format:

X-Powered-By: Qualys:<POD_ID>:<SUB_UUID>:<USER_UUID>

where,

- POD_ID is the shared POD or a PCP. Shared POD is USPOD1, USPOD2, etc.

- SUB_UUID is the unique ID generated for the subscription

- USER_UUID is the unique ID generated for the user. You can use the

USER_UUID to track API usage per user.

Sample X-Powered-By header

X-Powered-By: Qualys:QAPOD4SJC:f972e2cc-69d6-7ebd-80e6-

7b9a931475d8:06198167-43f3-7591-802a-1c400a0e81b1

Qualys Web Application Scanning API

Get Started

14

How to Download Vulnerability Details

/api/2.0/fo/knowledge_base/vuln/?action=list

[GET] [POST]

When you download web application scan results using the WAS API, you’ll

want to view vulnerability descriptions from the Qualys KnowledgeBase in

order to understand the vulnerabilities detected and see our recommended

solutions. You can do this programmatically using the KnowledgeBase

API (api/2.0/fo/knowledge_base/vuln/?action=list). This API function is part

of the Qualys API and it’s described in the Qualys API (VM, SCA, PC) User

Guide (click here to download the latest version)

Input Parameters

When filter parameters are specified, these parameters are ANDed

Parameter

Description

action=list (Required) A flag used to request the

download of vulnerability data from the

KnowledgeBase.

echo_request={

0

|1} (Optional) Show (echo) the request’s

input parameters (names and values) in

the XML output. When unspecified,

parameters are not included in the XML

output. Specify 1 to view parameters in the

output.

details={

Basic

|All|None} (Optional) Show the requested amount of

information for each vulnerability in the

XML output. A valid value is: Basic

(default), All, or None. Basic includes basic

elements plus CVSS Base and Temporal

scores. All includes all vulnerability details,

including the Basic details.

Qualys Web Application Scanning API

Get Started

15

ids={value} (Optional) Used to filter the XML output

to include only vulnerabilities that have

QID numbers matching the QID numbers

you specify.

id_min={value} (Optional) Used to filter the XML output

to show only vulnerabilities that have a

QID number greater than or equal to a

QID number you specify.

id_max={value} (Optional) Used to filter the XML output

to show only vulnerabilities that have a

QID number less than or equal to a QID

number you specify.

is_patchable={0|1} (Optional) Used to filter the XML output

to show only vulnerabilities that are

patchable or not patchable. A vulnerability

is considered patchable when a patch

exists for it. When 1 is specified, only

vulnerabilities that are patchable will be

included in the output. When 0 is

specified, only vulnerabilities that are not

patchable will be included in the output.

When unspecified, patchable and

unpatchable vulnerabilities will be

included in the output.

last_modified_after={date} (Optional) Used to filter the XML output

to show only vulnerabilities last modified

after a certain date and time. When

specified vulnerabilities last modified by a

user or by the service will be shown. The

date/time is specified in YYYY-MM-

DD[THH:MM:SSZ] format (UTC/GMT).

last_modified_

before={date}

(Optional) Used to filter the XML output

to show only vulnerabilities last modified

before a certain date and time. When

specified vulnerabilities last modified by a

user or by the service will be shown. The

Qualys Web Application Scanning API

Get Started

16

date/time is specified in YYYY-MM-

DD[THH:MM:SSZ] format (UTC/GMT).

last_modified_by_

user_after={date}

(Optional) Used to filter the XML output

to show only vulnerabilities last modified

by a user after a certain date and time.

The date/time is specified in YYYY-MM-

DD[THH:MM:SSZ] format (UTC/GMT).

last_modified_by_

user_before={date}

(Optional) Used to filter the XML output

to show only vulnerabilities last modified

by a user before a certain date and time.

The date/time is specified in YYYY-MM-

DD[THH:MM:SSZ] format (UTC/GMT).

last_modified_by_

service_after={date}

(Optional) Used to filter the XML output

to show only vulnerabilities last modified

by the service after a certain date and

time. The date/time is specified in YYYY-

MM-DD[THH:MM:SSZ] format (UTC/GMT).

last_modified_by_

service_before={date}

(Optional) Used to filter the XML output

to show only vulnerabilities last modified

by the service before a certain date and

time. The date/time is specified in YYYY-

MM-DD[THH:MM:SSZ] format (UTC/GMT).

published_after={date} (Optional) Used to filter the XML output

to show only vulnerabilities published

after a certain date and time. The

date/time is specified in YYYY-MM-

DD[THH:MM:SSZ] format (UTC/GMT).

published_before={date} (Optional) Used to filter the XML output

to show only vulnerabilities published

before a certain date and time. The

date/time is specified in YYYY-MM-

DD[THH:MM:SSZ] format (UTC/GMT).

discovery_method={value} (Optional) Used to filter the XML output

to show only vulnerabilities assigned a

certain discovery method. A valid value is:

Qualys Web Application Scanning API

Get Started

17

Remote, Authenticated, RemoteOnly,

AuthenticatedOnly, or

RemoteAndAuthenticated.

When “Authenticated” is specified, the

service shows vulnerabilities that have at

least one associated authentication type.

Vulnerabilities that have at least one

authentication type can be detected in

two ways: 1) remotely without using

authentication, and 2) using

authentication.

discovery_auth_types={value} (Optional) Used to filter the XML output

to show only vulnerabilities having one or

more authentication types. A valid value

is: Windows, Oracle, Unix or SNMP.

Multiple values are entered as a comma-

separated list.

show_pci_reasons={

0

|1} (Optional) Used to filter the XML output

to show reasons for passing or failing PCI

compliance (when the CVSS Scoring

feature is turned on in the user’s

subscription). Specify 1 to view the

reasons in the XML output. When

unspecified, the reasons are not included

in the XML output.

Sample - All vulnerabilities in KnolwedgeBase, all details

API request

curl -u "user:password" -H "X-Requested-With: Curl" -X "POST"

-d "action=list"

"https://qualysapi.qualys.com/api/2.0/fo/knowledge_base/vuln/" >

output.txt

Sample - Patchable vulnerabilities, all details

Qualys Web Application Scanning API

Get Started

18

API request

curl -u "user:password" -H "X-Requested-With: Curl" -X "POST"

-d "action=list&ids=1-

200&is_patchable=1&details=All" "https://qualysapi.qualys.com/api/2.0

/fo/knowledge_base/vuln/" > output.txt

Sample - Vulnerabilities modified after certain date

API request

curl -u "user:password" -H "X-Requested-With: Curl" -X "POST"

-d "action=list&last_modified_by_service_after=2018-07-20

&discovery_method=RemoteAndAuthenticated" "https://qualysapi.qualys.c

om/api/2.0/fo/knowledge_base/vuln/" > output.txt

DTD

<platform API

server>/api/2.0/fo/knowledge_base/vuln/knowledge_base_vuln_list_output.

dtd

Qualys Web Application Scanning API

Get Started

19

Know your portal version

/qps/rest/portal/version/

[GET] [POST]

Using the Version API you can find out the installed version of Portal and its

sub-modules that are available in your subscription.

Sample XML

API request

curl -u "USERNAME:PASSWORD" -X "GET" -H "Accept: application/xml"

https://qualysapi.qualys.com/qps/rest/portal/version

Response

<?xml version="1.0" encoding="UTF-8"?>

<ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:noNamespaceSchemaLocation="https://qualysapi.qualys.com/qps/xsd/ve

rsion.xsd">

<responseCode>SUCCESS</responseCode>

<data>

<Portal-Version>

<PortalApplication-VERSION>3.5.0.0-SNAPSHOT-1 DEVELOP #92

(2021-01-19T01:51:21Z)</PortalApplication-VERSION>

<ITAM-VERSION>1.3.1.0-18</ITAM-VERSION>

<CS-VERSION>1.9.0.0-SNAPSHOT</CS-VERSION>

<CA-VERSION>3.4.0.0</CA-VERSION>

<QGS-VERSION>1.2.0.0-6</QGS-VERSION>

<QUESTIONNAIRE-VERSION>2.26.0.0</QUESTIONNAIRE-VERSION>

<SAC-VERSION>1.0.0-SNAPSHOT</SAC-VERSION>

<WAF-VERSION>2.12.6.0</WAF-VERSION>

<QUESTIONNAIRE__V2-VERSION>1.13.1.0-

SNAPSHOT</QUESTIONNAIRE__V2-VERSION>

<WAS-VERSION>6.17.0.0-SNAPSHOT-32</WAS-VERSION>

<FIM-VERSION>2.6.0.0-23</FIM-VERSION>

<ICS-VERSION>0.9.1.0-12</ICS-VERSION>

<VM-VERSION>1.0.3</VM-VERSION>

<CERTVIEW-VERSION>2.8.0.0-20</CERTVIEW-VERSION>

Qualys Web Application Scanning API

Get Started

20

<CLOUDVIEW-VERSION>1.9.2.0-SNAPSHOT</CLOUDVIEW-VERSION>

<CM-VERSION>1.31.0.0</CM-VERSION>

<MDS-VERSION>2.16.1.0-SNAPSHOT-2</MDS-VERSION>

<PM-VERSION>1.5.0.0-2</PM-VERSION>

<PS-VERSION>1.3.0.0-16</PS-VERSION>

<IOC-VERSION>1.2.0-15</IOC-VERSION>

<THREAT__PROTECT-VERSION>1.5.0-SNAPSHOT</THREAT__PROTECT-

VERSION>

<AV2-VERSION>0.1.0</AV2-VERSION>

<UD-VERSION>1.0.0</UD-VERSION>

</Portal-Version>

<QWeb-Version>

<WEB-VERSION>10.7.0.0-1</WEB-VERSION>

<SCANNER-VERSION>12.1.68-1</SCANNER-VERSION>

<VULNSIGS-VERSION>2.5.84-2</VULNSIGS-VERSION>

</QWeb-Version>

</data>

</ServiceResponse>

Sample JSON

API request

curl -u "USERNAME:PASSWORD" -X "GET" -H "Accept: application/json"

https://qualysapi.qualys.com/qps/rest/portal/version

Response

{

"ServiceResponse": {

"data": [

{

"Portal-Version": {

"PortalApplication-VERSION": "3.5.0.0-SNAPSHOT-1 DEVELOP #92

(2021-01-19T01:51:21Z)",

"WAS-VERSION": "6.17.0.0-SNAPSHOT-32",

"VM-VERSION": "1.0.3",

"CM-VERSION": "1.20.1",

"MDS-VERSION": "2.16.1.0-SNAPSHOT-2",

"CA-VERSION": "2.9.1.0",

"QUESTIONNAIRE-VERSION": "2.14.0.4",

"WAF-VERSION": "2.12.6.0"

},

Qualys Web Application Scanning API

Get Started

21

...

}

],

"responseCode": "SUCCESS",

"count": 1

}

Qualys Web Application Scanning API

22

JSON Support

WAS API supports JSON requests and responses starting with WAS version

4.5. Samples are shown below.

Sample 1 - Create an option profile

API request

cat createOP.json | curl -s -X POST -H "Accept: application/json" -H

"Content-Type: application/json" -H "user: username" -H "password:

passwd" -d @-

"https://qualysapi.qualys.com/qps/rest/3.0/create/was/optionprofile/"

POST data:

{

"ServiceRequest": {

"data": {

"OptionProfile": {

"name": "OP creation - with json request and response",

"timeoutErrorThreshold": "10",

"unexpectedErrorThreshold": "20"

}

JSON output

{

"ServiceResponse": {

"data": [

{

"OptionProfile": {

"id": 464134,

"formSubmission": "BOTH",

"owner": {

"lastName": "Smith",

Qualys Web Application Scanning API

23

"username": "username",

"firstName": "Steve",

"id": 4354

},

"createdBy": {

"lastName": "Smith",

"username": "username",

"firstName": "Steve",

"id": 4354

},

"tags": {

"count": 0

},

"bruteforceOption": "MINIMAL",

"updatedBy": {

"lastName": "Smith",

"username": "username",

"firstName": "Steve",

"id": 4354

},

"maxCrawlRequests": 300,

"sensitiveContent": {

"creditCardNumber": "false",

"socialSecurityNumber": "false"

},

"updatedDate": "2015-12-15T13:39:25Z",

"comments": {

"count": 0

},

"createdDate": "2015-12-15T13:39:25Z",

"parameterSet": {

"name": "Initial Parameters",

"id": 0

},

"isDefault": "false",

"unexpectedErrorThreshold": 20,

"performance": "LOW",

"name": "OP creation - with json request and response",

"ignoreBinaryFiles": "false",

"timeoutErrorThreshold": 10

}

],

"count": 1,

"responseCode": "SUCCESS"

Qualys Web Application Scanning API

24

}

Sample 2 - Launch a scan

API request

cat createOP.json | curl -s -X POST -H "Accept: application/json" -H

"Content-Type: application/json" -H "user: username" -H "password:

passwd" -d @-

"https://qualysapi.qualys.com/qps/rest/3.0/launch/was/wasscan/"

POST data:

{

"ServiceRequest": {

"data": {

"WasScan": {

"name": "WebApp Default Auth",

"type": "VULNERABILITY",

"target": {

"webApp": { "id": "2640672" },

"webAppAuthRecord": { "isDefault": "true" }

},

"cancelAfterNHours": "1",

"profile": { "id": "450936" }

}

JSON output

{

"ServiceResponse" : {

"responseCode" : "SUCCESS",

"data" : [ {

"WasScan" : {

"id" : 1498381

}

} ],

"count" : 1

}

Sample 3 - Get a WAS scan

Qualys Web Application Scanning API

25

API request

cat createOP.json | curl -s -X POST -H "Accept: application/json" -H

"Content-Type: application/json" -H "user: username" -H "password:

passwd" -d @-

"https://qualysapi.qualys.com/qps/rest/3.0/launch/was/wasscan/"

POST data:

{

"ServiceRequest": {

"data": {

"WasScan": {

"name": "WebApp Default Auth",

"type": "VULNERABILITY",

"target": {

"webApp": { "id": "2640672" },

"webAppAuthRecord": { "isDefault": "true" }

},

"cancelAfterNHours": "1",

"profile": { "id": "450936" }

}

JSON output

{

"ServiceResponse" : {

"responseCode" : "SUCCESS",

"data" : [ {

"WasScan" : {

"id" : 1498381

}

} ],

"count" : 1

}

Sample 4 - Search WAS Findings with Multiple Criteria

API request

cat createOP.json | curl -s -X POST -H "Accept: application/json" -H

"Content-Type: application/json" -H "user: username" -H "password:

Qualys Web Application Scanning API

26

passwd" -d @-

"https://qualysapi.qualys.com/qps/rest/3.0/search/was/finding"

POST data:

{

"ServiceRequest": {

"preferences": {

"verbose": "true",

"limitResults": "2"

},

"filters": {

"Criteria": [

{

"field": "id",

"operator": "EQUALS",

"value": "3615376"

},

{

"field": "qid",

"operator": "NOT EQUALS",

"value": "0"

}

]

}

JSON output

{

"ServiceResponse": {

"data": [

{

"Finding": {

"url": "http://10.11.68.95/bricks/config/",

"lastDetectedDate": "2021-06-21T02:10:15Z",

"cwe": {

"count": 1,

"list": [

23

]

},

"id": 3615376,

"lastTestedDate": "2021-06-21T02:10:15Z",

"firstDetectedDate": "2021-06-21T02:10:15Z",

Qualys Web Application Scanning API

27

"findingType": "QUALYS",

"updatedDate": "2021-06-21T02:26:31Z",

"history": {

"set": [

{

"WebAppFindingHistory": {

"scanData": {

"reference": "was/1624029515335.1191085.70",

"launchedDate": "2021-06-21T02:10:15Z",

"id": 4255627

}

]

},

"potential": "false",

"status": "NEW",

"severity": "1",

"webApp": {

"id": 8777442,

"tags": {

"count": 0

},

"url": "http://10.11.68.95/digestApp",

"name": "Latest Target612"

},

"uniqueId": "0bfd3ee4-db6f-4d82-b970-1650a4186637",

"name": "Path-relative stylesheet import (PRSSI)

vulnerability",

"qid": 150246,

"cvssV3": {

"temporal": 2.9,

"attackVector": "Network",

"base": 3.1

},

"resultList": {

"count": 1,

"list": [

{

"Result": {

"ajax": "false",

"payloads": {

"count": 1,

"list": [

{

Qualys Web Application Scanning API

28

"PayloadInstance": {

"request": {

"headers":

"UmVmZXJlcjogaHR0cDovLzEwLjExLjY4Ljk1L2RpZ2VzdEFwcA0KQ29va2llOiBQSFBTR

VNTSUQ9bzAxNm5hMWpnZXZhNmF2OTltdWwxcjRrdDM7DQpIb3N0OiAxMC4xMS42OC45NQ0

KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggM

TBfMTRfNSkgQXBwbGVXZWJLaXQvNjA1LjEuMTUgKEtIVE1MLCBsaWtlIEdlY2tvKSBWZXJ

zaW9uLzEyLjEuMSBTYWZhcmkvNjA1LjEuMTUNCkFjY2VwdDogKi8qDQo=",

"method": "GET",

"link":

"http://10.11.68.95/bricks/config/"

},

"response": "\nRelative Path CSS Links

found:\n<link rel=\"stylesheet\"

href=\"../stylesheets/foundation.css\">\n<link rel=\"stylesheet\"

href=\"../stylesheets/foundation.min.css\">\n<link rel=\"stylesheet\"

href=\"../stylesheets/app.css\">",

"payload": "N/A"

}

]

},

"authentication": "false"

}

]

},

"isIgnored": "false",

"timesDetected": 1,

"type": "VULNERABILITY"

}

],

"responseCode": "SUCCESS",

"hasMoreRecords": "false",

"count": 1

}

Qualys Web Application Scanning API

29

YAML Support

WAS API supports YAML requests and responses starting with WAS version

8.17. Sample is shown below.

Sample 1 - Create a web application

API request

curl -u "USERNAME:PASSWORD" -H "content-type: text/xml" -X "POST" --

data-binary @-

"https://qualysapi.qualys.com/qps/rest/3.0/create/was/webapp/" <

file.xml

Note: “file.xml” contains the request POST data.

POST data:

<data>

<content>LS0tCnN3YWdnZXI6ICcyLjAnCmluZm86CiAgZGVzY3JpcHRpb246IFRoaXMga

XMgYSBzYW1wbGUgUkVTVCBhcGkgc2VydmVyLgogIHZlcnNpb246IDEuMC4wCiAgdGl0bGU

6IFN3YWdnZXIgV2l0aCBWdWxuZXJhYmlsaXR5CiAgdGVybXNPZlNlcnZpY2U6IGh0dHA6L

y9zd2FnZ2VyLmlvL3Rlcm1zLwogIGNvbnRhY3Q6CiAgICBlbWFpbDogYWJjQGd4bWFpbC5

jb20KICBsaWNlbnNlOgogICAgbmFtZTogQXBhY2hlIDIuMAogICAgdXJsOiBodHRwOi8vd

3d3LmFwYWNoZS5vcmcvbGljZW5zZXMvTElDRU5TRS0yLjAuaHRtbApob3N0OiAxMC4xMS4

2OS4yMQpiYXNlUGF0aDogIi9KU09OIgp0YWdzOgotIG5hbWU6IHNlYXJjaAogIGRlc2Nya

XB0aW9uOiBTZWFyY2gKICBleHRlcm5hbERvY3M6CiAgICBkZXNjcmlwdGlvbjogRmluZCB

vdXQgbW9yZQogICAgdXJsOiBodHRwOi8vc3dhZ2dlci5pbwotIG5hbWU6IHNlYXJjaDIKI

CBkZXNjcmlwdGlvbjogQWNjZXNzIHRvIFBldHN0b3JlIG9yZGVycwotIG5hbWU6IHVzZXI

KICBkZXNjcmlwdGlvbjogT3BlcmF0aW9ucyBhYm91dCB1c2VyCiAgZXh0ZXJuYWxEb2NzO

gogICAgZGVzY3JpcHRpb246IEZpbmQgb3V0IG1vcmUgYWJvdXQgb3VyIHN0b3JlCiAgICB

1cmw6IGh0dHA6Ly9zd2FnZ2VyLmlvCnNjaGVtZXM6Ci0gaHR0cApwYXRoczoKICAiLzIvY

WpheF9zZWFyY2hfMS5waHAiOgogICAgcG9zdDoKICAgICAgdGFnczoKICAgICAgLSBzZWF

yY2gKICAgICAgc3VtbWFyeTogU2VhcmNoIGZvciBoaXN0b3J5CiAgICAgIGRlc2NyaXB0a

W9uOiAnJwogICAgICBvcGVyYXRpb25JZDogc2VhcmNoMQogICAgICBjb25zdW1lczoKICA

Qualys Web Application Scanning API

30

gICAgLSBhcHBsaWNhdGlvbi9qc29uCiAgICAgIHByb2R1Y2VzOgogICAgICAtIHRleHQva

HRtbAogICAgICBwYXJhbWV0ZXJzOgogICAgICAtIGluOiBib2R5CiAgICAgICAgbmFtZTo

gYm9keQogICAgICAgIGRlc2NyaXB0aW9uOiBTZWFyY2ggcGFyYW1ldGVycwogICAgICAgI

HJlcXVpcmVkOiB0cnVlCiAgICAgICAgc2NoZW1hOgogICAgICAgICAgIiRyZWYiOiAiIy9

kZWZpbml0aW9ucy9TZWFyY2gxIgogICAgICByZXNwb25zZXM6CiAgICAgICAgJzIwMCc6C

iAgICAgICAgICBkZXNjcmlwdGlvbjogU3VjY2VzcwogICAgICAgICc0MTUnOgogICAgICA

gICAgZGVzY3JpcHRpb246IFVuc3VwcG9ydGVkIG1lZGlhCiAgICAgICAgJzQyOSc6CiAgI

CAgICAgICBkZXNjcmlwdGlvbjogVG9vIG1hbnkgcmVxdWVzdHMKICAgICAgICBkZWZhdWx

0OgogICAgICAgICAgZGVzY3JpcHRpb246IERlZmF1bHQgZXJyb3IgcmVzcG9uc2UKICAiL

zIvYWpheF9zZWFyY2hfMi5waHAiOgogICAgcG9zdDoKICAgICAgdGFnczoKICAgICAgLSB

zZWFyY2gyCiAgICAgIHN1bW1hcnk6IFNlYXJjaCBmb3IgaGlzdG9yeTIKICAgICAgb3Blc

mF0aW9uSWQ6IHNlYXJjaDIKICAgICAgY29uc3VtZXM6CiAgICAgIC0gYXBwbGljYXRpb24

vanNvbgogICAgICBwcm9kdWNlczoKICAgICAgLSB0ZXh0L2h0bWwKICAgICAgcGFyYW1ld

GVyczoKICAgICAgLSBpbjogYm9keQogICAgICAgIG5hbWU6IGJvZHkKICAgICAgICBkZXN

jcmlwdGlvbjogU2VhcmNoIHBhcmFtZXRlcnMKICAgICAgICByZXF1aXJlZDogdHJ1ZQogI

CAgICAgIHNjaGVtYToKICAgICAgICAgICIkcmVmIjogIiMvZGVmaW5pdGlvbnMvU2VhcmN

oMiIKICAgICAgcmVzcG9uc2VzOgogICAgICAgICcyMDAnOgogICAgICAgICAgZGVzY3Jpc

HRpb246IFN1Y2Nlc3MKICAgICAgICAnNDE1JzoKICAgICAgICAgIGRlc2NyaXB0aW9uOiB

VbnN1cHBvcnRlZCBtZWRpYQogICAgICAgICc0MjknOgogICAgICAgICAgZGVzY3JpcHRpb

246IFRvbyBtYW55IHJlcXVlc3RzCiAgICAgICAgZGVmYXVsdDoKICAgICAgICAgIGRlc2N

yaXB0aW9uOiBEZWZhdWx0IGVycm9yIHJlc3BvbnNlCmRlZmluaXRpb25zOgogIFNlYXJja

DE6CiAgICB0eXBlOiBvYmplY3QKICAgIHByb3BlcnRpZXM6CiAgICAgIGxpbWl0OgogICA

gICAgIHR5cGU6IGludGVnZXIKICAgICAgICBmb3JtYXQ6IGludDY0CiAgICAgICAgbWF4a

W11bTogMjAwMAogICAgICAgIG1pbmltdW06IDEwCiAgICAgIG9yZGVyOgogICAgICAgIHR

5cGU6IHN0cmluZwogICAgICAgIGVudW06CiAgICAgICAgLSBhc2MKICAgICAgICAtIGRlc

2MKICAgICAgdGVybToKICAgICAgICB0eXBlOiBzdHJpbmcKICAgICAgICBtaW5MZW5ndGg

6IDEKICAgICAgICBtYXhMZW5ndGg6IDIwCiAgICAgICAgcGF0dGVybjogIlthLXpBLVowL

TlfXSIKICBTZWFyY2gyOgogICAgdHlwZTogb2JqZWN0CiAgICBwcm9wZXJ0aWVzOgogICA

gICBsaW1pdDI6CiAgICAgICAgdHlwZTogaW50ZWdlcgogICAgICAgIGZvcm1hdDogaW50N

jQKICAgICAgICBtYXhpbXVtOiAyMDAwCiAgICAgICAgbWluaW11bTogMTAKICAgICAgb3J

kZXIyOgogICAgICAgIHR5cGU6IHN0cmluZwogICAgICAgIGVudW06CiAgICAgICAgLSBhc

2MKICAgICAgICAtIGRlc2MKICAgICAgdGVybTI6CiAgICAgICAgdHlwZTogc3RyaW5nCiA

gICAgICAgbWluTGVuZ3RoOiAxCiAgICAgICAgbWF4TGVuZ3RoOiAyMAogICAgICAgIHBhd

HRlcm46ICJbYS16QS1aMC05X10iCiAgICAgIG9mZnNldDI6CiAgICAgICAgdHlwZTogaW5

0ZWdlcgogICAgICAgIGZvcm1hdDogaW50NjQKICAgICAgICBtYXhpbXVtOiAyOTM4MjQ3M

zIKICAgICAgICBtaW5pbXVtOiAxCmV4dGVybmFsRG9jczoKICBkZXNjcmlwdGlvbjogRml

uZCBvdXQgbW9yZSBhYm91dCBTd2FnZ2VyCiAgdXJsOiBodHRwOi8vc3dhZ2dlci5pbwo=<

/content>

</swaggerFile>

</WebApp>

</data>

</ServiceRequest>

YAML output

Qualys Web Application Scanning API

31

<?xml version="1.0" encoding="UTF-8"?>

<ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-

instance" xsi:noNamespaceSchemaLocation="https://qualysapi.qualys.com/

qps/xsd/3.0/was/webapp.xsd">

<responseCode>SUCCESS</responseCode>

<data>

<name>

<![CDATA[TEST YAML API]]>

</name>

<url>

<![CDATA[http://10.12.14.16]]>

</url>

<owner>

<username>quays_abc</username>

<![CDATA[John]]>

</firstName>

<![CDATA[Doe]]>

</lastName>

</owner>

</attributes>

<type>EXTERNAL</type>

</defaultScanner>

<scannerLocked>false</scannerLocked>

<progressiveScanning>DISABLED</progressiveScanning>

</urlExcludelist>

</urlAllowlist>

</postDataExcludelist>

Qualys Web Application Scanning API

32

</logoutRegexList>

</authRecords>

</dnsOverrides>

<useRobots>IGNORE</useRobots>

<useSitemap>false</useSitemap>

<malwareMonitoring>false</malwareMonitoring>

<malwareNotification>false</malwareNotification>

<tags>

</tags>

</comments>

<isScheduled>false</isScheduled>

<username>quays_abc</username>

<![CDATA[John]]>

</firstName>

<![CDATA[Doe]]>

</lastName>

</createdBy>

<username>quays_abc</username>

<![CDATA[John]]>

</firstName>

<![CDATA[Doe]]>

</lastName>

</updatedBy>

</crawlingScripts>

Qualys Web Application Scanning API

33