expand Randomness description

[GoogleCodeExporter]

low priority documentation enhancement request

Expand description of how randomness is used outside the "-p" option.

Currently the doc just says
  "Randomness is relied upon most heavily in the -p mode, but also for making a couple of other scan management decisions elsewhere."

(I'm trying to determine if seeing an issue identified in a later scan that 
wasn't
in an earlier scan is likely due to the scans being run with different
random seeds.)

Original issue reported on code.google.com by b4sw...@gmail.com on 30 Aug 2011 at 12:35

[GoogleCodeExporter]

The short story is that the seed should have no substantial impact if you're 
not using -p. The reason you might be seeing differences between scans could be 
that:

1) Skipfish learned a new keyword in one scan, and used it in another,

2) Skipfish exploited a vulnerability (such as stored XSS) in one scan, but 
discovered the result only in another.

3) Skipfish could not reach all the locations in one scan, for example due to a 
server error or a timeout; but had more luck in the next run.

4) Some other parallelism-related quirks.

Original comment by lcam...@gmail.com on 30 Aug 2011 at 1:35

• Changed state: WontFix