Qualys WAS — Web Application Scanning from OWASP to API Security

① What Qualys WAS actually is — dynamic scanning inside VMDR

Qualys WAS is the web application scanning module inside Qualys VMDR. Where the VMDR asset scanner identifies missing patches and network-level CVEs by reading service banners and version strings, WAS is a DAST engine: it sends real HTTP requests to a running application, crawls links and forms, injects payloads, and observes the response. That means it can find OWASP Top 10 issues — SQL injection, XSS, broken authentication, sensitive data exposure — that never appear in a CVE feed.

WAS runs from the Qualys cloud, so there is nothing to install on the app server. You point it at a URL, configure a scan profile (light, thorough, or custom), and it does the crawling. Findings land in the VMDR unified dashboard alongside infrastructure CVEs, letting you apply TruRisk scoring across both attack surfaces in one view.

② Authenticated scans & API coverage — reaching everything WAS can reach

Unauthenticated scanning only sees the public face of your app. The real attack surface is behind the login. WAS handles this through authenticated scans: you store credentials or record a Selenium-style login sequence, and WAS replays the session for every crawl. Cookies and tokens are refreshed automatically so the scan does not time out mid-way through a large app.

Swagger / OpenAPI import

REST APIs are often not discoverable by crawling alone — endpoints only appear in documentation. WAS lets you upload a Swagger/OpenAPI file (JSON or YAML, OpenAPI v2 or v3). WAS parses the spec and generates test cases for every documented endpoint, checking for the OWASP API Top 10 — broken object-level authorisation, excessive data exposure, improper rate limiting and more — using over 200 prebuilt signatures. This is the only reliable way to achieve full API coverage when endpoints are not linked from any UI page.

③ Malware detection & WAF integration — the two runtime concerns

A web application can be exploited and have malware injected into its response pages — a script tag that loads a skimmer or a redirect to a phishing site. Qualys WAS includes web malware detection as part of every subscription. The scanner fetches live page responses and checks them against deep-learning-based signatures. When malware is found it appears as a finding in the same dashboard as OWASP findings, so there is one place to triage both vulnerability and compromise signals.

WAF integration — scanning without being blocked

If a WAF sits in front of your app, aggressive scan traffic can look like an attack and get blocked. WAS handles this two ways: first, add the Qualys scanner IP range to the WAF allowlist; second, configure header injection — WAS adds a unique custom HTTP header to every scan request, and the WAF is told to pass traffic bearing that header without inspection. This keeps the WAF blocking real attacks while letting scan traffic through unfiltered.

④ Reports & triage — reading a WAS finding and acting on it

Every WAS finding has a QID (Qualys vulnerability ID), a severity (1–5), a URL, the exact parameter or header that was tested, the payload that triggered the response, and a proof screenshot where relevant. Findings are tagged to OWASP Top 10 or OWASP API Top 10 categories so you can export compliance-ready reports directly. The scan report also surfaces sensitive content exposure — credit-card patterns, SSNs, or private keys found in page responses.

Because WAS findings land in the VMDR unified dashboard, you can combine them with infrastructure CVEs and apply TruRisk-based prioritisation across both. A critical XSS on a public-facing checkout page and a critical OS CVE on the same host appear together, letting you decide which to patch first based on real business risk rather than raw CVSS. From the dashboard you can assign findings to a ticket, set a due date, and track remediation status — the same workflow as for network CVEs.