Provide Additional Documentation When Dealing With Authentication Request
Hello,
I do not like being the Noob however, from scanning some of the forums I do not think I am the only one who is having problems understanding how to use arachni when scanning web apps that require authentication. I think this tool has a lot of potential and is definitely well received from what I can tell within the security community but I have spent the majority of a week trying to understand how to use this tool on authenticated sites and so far I am not having a lot of good luck.
Perhaps it is possible to give step by step examples when using this with authenticated sites or post a couple of video tutorials or something like this? I feel personally there is something simple I am not understanding and I think it would help me out a lot if I could follow along and re-duplicate what someone has already done and I am betting I am not the only person who would benefit from this. This is just my opinion.
R
Joe
Keyboard shortcuts
Generic
| ? | Show this help |
|---|---|
| ESC | Blurs the current field |
Comment Form
| r | Focus the comment reply box |
|---|---|
| ^ + ↩ | Submit the comment |
You can use Command ⌘ instead of Control ^ on Mac
Support Staff 1 Posted by Tasos Laskos on 04 May, 2018 08:38 AM
Thing is that there's not more documentation to provide, once you're in a login script then you just use the Watir API to control the PhantomJS browser and interact with the webapp.
There could be bugs in Arachni if the script doesn't work or in Watir or maybe PhantomJS doesn't support the webapp for some reason (it's getting old, the new engine will have modern browsers), but there's really not much to document from my side.
To verify that your script is correct you can run it as a regular Ruby script that uses Watir and PhantomJS, completely outside Arachni; if it works, then the issue is with Arachni, if not then I can't do much about it.
Now, if you're unfamiliar with Ruby or Watir then that's way outside the scope of Arachni's documentation, you can educate yourself on those subjects as would anyone else that would like to use those tools.
Although, I guess I could add what I just wrote to the documentation to make things absolutely clear from the start, other than that though I don't see what else I can do.
Maybe also add a login script validation plugin that runs everything outside Arachni to make it easier to pinpoint where the issue lies?
Thoughts?