Home → Questions →

Login failing in Arachni scan

• Edit

Mike

17 Aug, 2016 05:29 PM

I see the following in my log for the Jenkins job. I can log into the url no problem with the user/pwd that I have in the job. Any help/thought/ideas are appreciated.

[*] Initializing...
[*] Preparing plugins...
[*] AutoLogin: Logging in, please wait.
[-] [utilities#exception_jail:428] Session: [Arachni::Session::Error::FormNotFound] Login form could not be found with: {:url=>"http://xyz/home/index.html", :inputs=>{"UserID"=>"abc", "UserPassword"=>"pwd"}}
[-] Session: [Errno::EACCES] Permission denied @ rb_sysopen - /opt/arachni-1.4-0.5.10/bin/../system/logs/framework/error-4002.log

1. Support Staff 1 Posted by Tasos Laskos on 17 Aug, 2016 07:27 PM

   

   You've got 2 issues there:

   1. There is no form with UserID and UserPassword inputs at http://xyz/home/index.html. If it's a redirect prefer setting the URL with the actual form.
      
   2. You've got Arachni placed at a directory for which it doesn't have write privileges.
   • Edit

2. 2 Posted by Brendan on 17 Aug, 2016 07:57 PM

   

   Here is a snippet for the /home/index.html containing the

   and elements to help clarify the underlying source code.

   https://gist.github.com/bmurtagh/891beff6b7cd5917a6c3f04120bdb346

   • Edit

3. Support Staff 3 Posted by Tasos Laskos on 17 Aug, 2016 07:59 PM

   

   Is the form visible by default or do you need to interact with the page somehow?

   • Edit

4. 4 Posted by Mike on 17 Aug, 2016 08:10 PM

   

   Hitting that url brings up the page

   • Edit

5. Support Staff 5 Posted by Tasos Laskos on 17 Aug, 2016 08:12 PM

   

   Hm, I can't tell for sure without access to the page, but you may need to configure this option: https://github.com/Arachni/arachni/wiki/Command-line-user-interface...

   • Edit

6. 6 Posted by Brendan on 17 Aug, 2016 08:13 PM

   

   Here is a temporary screenshot of the login form: http://imgur.com/QQZI0LK

   We have a /UI/index.html that acts as a launch page that opens a new window with this form on there. We're using that new URL /home/index.html in the arachni scanning configuration.

   • Edit

7. Support Staff 7 Posted by Tasos Laskos on 17 Aug, 2016 08:15 PM

   

   Like I said, I can't tell for sure but if there's some delay in loading or interaction of some sort you may need to resort to the login_script approach.

   • Edit

8. 8 Posted by Brendan on 17 Aug, 2016 08:21 PM

   

   Is it possible to see if there's a rendering delay in debug output?

   Also, is it possible to set an ENV var for debug or is only a CLI flag the option?

   • Edit

9. Support Staff 9 Posted by Tasos Laskos on 17 Aug, 2016 08:23 PM

   

   It's just CLI, --output-debug=2 will show you the rendered HTML body at the time the form was being located.

   • Edit

10. 10 Posted by Brendan on 17 Aug, 2016 09:05 PM

    

    Here is some code from the rendered version as you can see, there's the

    and elements as expected: https://gist.github.com/bmurtagh/b67d26ce97b98e68e86eee468dae68bc
    • Edit

11. Support Staff 11 Posted by Tasos Laskos on 18 Aug, 2016 08:53 AM

    

    Any chance I can get access to that page?

    • Edit

12. 12 Posted by Brendan on 18 Aug, 2016 12:28 PM

    

    We will inquire this morning about permission/approval to send the URL. Is there a way to send the URL privately if we get approval?

    • Edit

13. Support Staff 13 Posted by Tasos Laskos on 18 Aug, 2016 12:29 PM

    

    Yep: [email blocked]

    • Edit

14. 14 Posted by Brendan on 18 Aug, 2016 01:55 PM

    

    Your message came across as [email blocked].

    • Edit

15. Support Staff 15 Posted by Tasos Laskos on 18 Aug, 2016 01:56 PM

    

    My bad: tasos[dot]laskos[at]arachni-scanner.com

    • Edit

16. 16 Posted by Brendan on 18 Aug, 2016 02:17 PM

    

    Thank you for the continued help. We had one of our InfoSec guys look at it and we are having issues due to Angular (v2 specifically) being used which is not making arachni happy. He has some login scripts he'll be customizing for our usage.

    Thank you again for the help & developing a great product!

    • Edit

17. 17 Posted by Mike on 18 Aug, 2016 02:19 PM

    

    Thanks again, wish more products provided this level of support/response!

    • Edit

18. Support Staff 18 Posted by Tasos Laskos on 18 Aug, 2016 02:20 PM

    

    No worries guys.

    About your issue, there's a known incompatibility, please follow this for updates: https://github.com/Arachni/arachni/issues/764

    Cheers

    • Edit

19. Tasos Laskos closed this discussion on 18 Aug, 2016 02:20 PM.