Scanning SharePoint 2013 with HP WebInspect

Question

I'm working with a client that is using HP WebInspect to scan a SharePoint 2013 web application before the roll-out. The custom solutions can't be deployed if HP WebInspect finds something that is vulnerable EVEN if that thing is just a built-in SharePoint object.

My team has completed developing three custom solutions. Recently the tool couldn't connect to scan these site collection including our custom solutions and throwed Time-out connection error. I enabled Anonymous access to the entire site collection and even granted anonymous access to each list in the site collection. The tool then was able to scan my site collection. Doing the same with the other two solutions, the tool can't connect to scan. Time-out connection error has happened again. 

Has anyone experienced such a case? The WebInspect is really expensive and doesn't allow testing multiple sites so I can't test it in my local environment. Asking the client to look into WebInspect wouldn't be possible.

By the way, I'm going to ask my client to configure like the recommendation in this thread: http://h30499.www3.hp.com/t5/WebInspect/Scanning-Drupal-and-or-Sharepoint/td-p/5417319#.U6W5NxaYah8 
Any suggestions would be very much appreciated.

Answer 1

Your tool may not have the access level that is needed for SharePoint, if it connects to SP as a service and that service account does not have permissions you would get no access.

But as you said, Enabling anonymous access fix the issue. I am positive that some permission is not right.check the account underwhich tool is running, may be add that account as site collection ADMIN or as policy for web app.

i would also recommend to contact the vendor's support.

alos have a look on this: http://h30499.www3.hp.com/t5/WebInspect/Audit-Not-Progressing-for-SharePoint-Scan/td-p/5948275#.U6cN0vldW30