Home → Questions →

About autologin's params

• Edit

Yanjin Ding

19 Sep, 2012 07:19 PM

Hi team,

I know the format of autologin's params is "username=myusername&password=mypassword". But I noticed that you check whether a form is login form by checking if this form's parameters contain "username" and "password". Many login forms have various names for username and password input fields, like "user", "uid", "passwd", "pwd", etc. Can Arachni handle them automatically? Or users must specify names for these input fields? Thank you.

Regards,
Yanjin

1. Support Staff 1 Posted by Tasos Laskos on 19 Sep, 2012 07:48 PM

   

   Hi Yanjin,

   If you read the option descriptions:

    [*] autologin:
   --------------------
   Name:       AutoLogin
   Description:    It looks for the login form in the user provided URL,
                   merges its input fields with the user supplied parameters and sets the cookies
                   of the response and request as framework-wide cookies to be used by the spider later on.
   
   Options:    
    [~]    url - The URL that contains the login form.
    [~]    Type:        url
    [~]    Default:     
    [~]    Required?:   true
   
    [~]    params - Form parameters to submit. ( username=user&password=pass )
    [~]    Type:        string
    [~]    Default:     
    [~]    Required?:   true
   
    [~]    check - A pattern which will be used to verify a successful login.
                       For example, if a logout link only appears when a user is logged in then it can be a perfect choice.
    [~]    Type:        string
    [~]    Default:     
    [~]    Required?:   true
   

   It doesn't really expect the username and password values, it expects the form parameters which need to be filled in, as a query string.
   The form to be submitted is then located based on the parameter names in the query -- and is also updated before each login attempt in case there are tokens that need to be refreshed.

   Cool tip: The suggested article for your question would have explained this in even more detail.

   • Edit

2. Tasos Laskos closed this discussion on 19 Sep, 2012 07:48 PM.