1

I have scanned my website using Nessus.But I need to scan it as logged in user since most of the urls are accessible only if we are logged in.How can I set website login credentials in Nessus?

  • Login mechanisms differs from site to site, can't you just disable the login mechanism or make an auto-login from a certain IP? Otherwise try your favorite search engine – HamZa Apr 30 '14 at 10:08
  • I have searched in google before asking here..didn't get solution..'Scaning by login mechanism disabled' seems good idea..Will check that... – Harikrishnan Apr 30 '14 at 17:00
2

Nessus 5 made a change: It's in the Preferences section:

  • Login configurations
  • HTTP login page

There you can set your HTTP credentials/settings.

This is a basic check in the documentation. Why go Google, when you can RTFM....

2

Nessus has the information posted on their page with a full walk through. http://www.tenable.com/tips/how-to-enable-credentialed-checks-on-windows

  • 2
    No. It's for log in to the remote host (Remote login) and scan. It's not for website login. – Harikrishnan Apr 30 '14 at 16:52
  • Munkeyoto has the right idea, but the wrong section. There's a section for basic authentication. – schroeder Apr 30 '14 at 17:47
1

There are two ways:

  • Cookie import: First you have to export them from your browser in netscape format. Read more here

  • Http Login Parameters: An article demonstrating this option is here.

    Moreover, the steps as described in the documentation are the following:

    1. Create new scan
    2. Web Application Tests
    3. Credentials: which are filled out like these (taken from documentation):

      • Username: Login user’s name.
      • Password: Password of the user specified.
      • Login page: The absolute path to the login page of the application, e.g., /login.html

      • Login submission page: The action parameter for the form method. For example, the login form for: would be: /login.php

      • Login parameters: Specify the authentication parameters (e.g., login=%USER%&password=%PASS%). If the keywords %USER% and %PASS% are used, they will be substituted with values supplied on the Login configurations drop-down menu. This field can be used to provide more than two parameters if required (e.g., a group name or some other piece of information is required for the authentication process).

      • Check authentication on page: The absolute path of a protected web page that requires authentication, to better assist Nessus in determining authentication status, e.g., /admin.html.

      • Regex to verify successful authentication: A regex pattern to look for on the login page. Simply receiving a 200 response code is not always sufficient to determine session state. Nessus can attempt to match a given string such as Authentication successful

However, in my case (drupal 6), it couldn't authenticate

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.