IBM Security AppScan Glass Box???????μ??????????

????Glass Box ?? IBM Security AppScan Standard Edition???????? AppScan??8.5 ?汾?????????????μ????????? AppScan ??????????????Glass Box ?????????????????????????????????????????????????????????? Web ?????????????????з??????????????? AppScan??? AppScan ????????????????????裬??????????????????????????????????
????Glass Box ?????????? AppScan ??????μ????????????????????μ?????????????????????? AppScan ??в????????????????? Web ??ó??????????????????????????????????????????????Ч????????????????????????
???????
????Glass Box ?? IBM Security AppScan Standard Edition???????? AppScan??8.5 ?汾?????????????μ????????? AppScan ??????????????Glass Box ?????????????????????????????????????????????????????????? Web ??ó?????????????з??????????????? AppScan??? AppScan ????????????????????裬??????????????????????????????????Glass Box ?????????? AppScan ??????μ????????????????????μ?????????????????????? AppScan ??в????????????????? web ??ó?????д?????????????????????????????????????Ч????????????????????????
??????????????????? AppScan Glass Box ???????????????????? AppScan 8.5 ?? Glass Box ?? Windows XP ?????Ч????Glass Box ??? WebSphere??Tomcat??JBoss ???????÷??????????????? Web ??????????????? Tomcat 7.0??
???????????
????Glass Box ????????????????????????? GlassAPI ?? Glass Box ???????GlassAPI ?????????????????????????????????????Glass Box ?????????????????????????????????????з??????ж??????????????????????????????????????????????? Web ??ó?????????????????????????????????????????????????????????????????????????????? Web ?????????????????????????????????????

????? 1. Glass Box ????????

????
???????ü????
???????????????壬??? Glass Box ???????á???? Glass Box ????е????????????? Glass Box ???????

????? 2. Glass Box ?????????

????
????????????????????????????? Glass Box ??趨??????????????????????????????? AgentCredentials.bat <username> <password> ??????????λ?? GBootStrapWEB-INF ???μ? users.xml ????????? Tomcat ????Ч???????????? Glass Box ????????? AppScan ??????????????е?????????????????????? Glass Box ????????????"??????????? glass box "???????????????? URL?????"?????????? glass box"????????????????????????????????????ó????AppScan ??????????????"Glass box ??裺??????"??
????Glass Box ???ó????????? Web ??ó?????????衣?????????????? Glass Box ?? URL ???????????豾??????????????????????????? URL ??????“http://localhost/myproject”?? ???????“http://mysite/myproject”??Glass Box ??????? Java ?????????????????????? IBM AppScan ??????????? AltoroJ ?????
????????????? Glass Box ????????????з?????????????????? Glass Box ????????????????????????????????????????????????????裬????????????????????????????????????κ?????????????ж??????з??????????????????????裬???????????в???????????????ü?????????????????????????????????
????1. ????????????????????в??????????? cookie ????????????????·?????????踲?????
????????ó????У????Щ??????δ???????????????????"?????"???????? AppScan ???????????????????????Щ??????????????????????檔 Glass Box ????????????????????????Щ"?????"????????? getParameter??Runtime.getRuntime().exec ??????????????Щ??????????У???????????????е?????????????????????????·????
????2. ??????Σ?Glass Box ????? AppScan ??????????????????
????Glass Box ????????????????????????????? AppScan ???????????????????????? AppScan ?????????????????????????á?????????????????????洢??????????????? AltoroJ ??????????????? Glass Box ??????????? 100 ????????????? Glass Box ??????赽?? 139 ???????Glass Box ?????????? 40% ???????跢?????????±?????? OWASP Top 10 ???????????????? Glass Box ?????????????????е????

?????? 1. ??? Glass Box ????????????????

?????????Web ????????????δ?????????????????????????棬???????????????????棬AppScan ??????? response ??????ж????????????Glass Box ???????????????????????????????????ж????????????
??????????????????δ??? Glass Box ???AppScan ??δ?????????????? SQL ????????AppScan ???????????????????δ?????????? SQL ????????????????????????????????????