Configuring Form Authentication in Invicti Standard

Invicti Standard has a form authentication mechanism that makes it easy to configure scans for websites that require user authentication.

The form authentication mechanism in Invicti Standard fills and submits login forms on your websites by means of the DOM of the login form page. This means that it does so without the need to record any login macros. It automatically detects the login form components, the username, and the password inputs. It then populates them and submits the login form. To do this, you only need to configure:

• Login form URL
• Credentials (username & password)

For further information, see Custom Scripts for Form Authentication.

Form Authentication Fields

This table lists and describes the fields in the Form Authentication tab.

How to configure form authentication in Invicti Standard

1. Open Invicti Standard.
2. From the Home tab, click New. The Start a New Website or Web Service Scan dialog is displayed.
3. Select the Form tab. The Form Authentication section is displayed.

4. Check the Enabled checkbox.
5. In Login Form URL, enter the URL.
6. In the Username field, enter a username.
7. In the Password field, enter a password. Use the Show/Hide Password button () if required.

8. If required, click the ellipsis in the OTP field (see Configuring Form Authentication using an OTP).
9. Select Verify Login & Logout to verify the credentials. (For further information, see Verifying the Form Authentication Configuration in Invicti Standard.)
10. Click Start Scan.

Configuring a Login Form URL

The login form URL that should be configured in Invicti is the URL of the page where your login form resides. Most websites have URLs like http://www.example.com/Login/ for their users to authenticate. It is also common for websites to have their login form on their homepages, usually somewhere located in the header or sidebar. If this is the case, specify your website’s home page URL in Invicti as the login form URL.

Invicti has a better chance of detecting and filling the login form on pages dedicated to the login operation, so always specify the dedicated login form URL if you have a login form both on your homepage and on a dedicated login page. 

How to Configure a Login Form URL in Invicti Standard

1. Open Invicti Standard.
2. From the Home tab, click New. The Start a New Website or Web Service Scan dialog is displayed.
3. Select the Form tab. The Form Authentication panel is displayed.
4. Select the Enabled checkbox.
5. In Login Form URL, enter the URL that contains your dedicated login form page.
6. Continue from step 6 of How to Configure Automatic Form Authentication in Invicti Standard.

Configuring Multiple Sets of Credentials and URLs

The other piece of information Invicti requires for authenticating during a web application security scan are the credentials. You can enter more than a single set of credentials to simulate the different kinds of personas your website supports, such as one for regular users and one for admin users. This way, you will be able to easily switch between accounts and perform authenticated scans with different user accounts which have different privileges.

How to Configure Multiple Sets of Credentials and URLs in Invicti Standard

1. Open the Invicti Standard.
2. From the Home tab, click New. The Start a New Website or Web Service Scan dialog is displayed.
3. Select the Form tab. The Form Authentication section is displayed.
4. Enable the Enabled checkbox.
5. In Login Form URL, enter the URL.
6. Click in the blank space below the first persona. A new space for another persona is displayed.
7. In the Username field, enter the username.
8. In the Password field, enter the password. Use the Show/Hide Password button () as required.

9. Continue to add rows and login credentials for as many other personas as you need. (Remember that only one persona can be used in single scans. Different scans should be run for each persona.)

10. Click Start Scan.

Configuring Form Authentication Using an OTP

Invicti Standard supports form authentication using a One-Time-Password (OTP). By providing this type of 2FA via a Secret Key, Invicti Standard enables the OTP to be filled in automatically so that Invicti can access and can scan all sections of the target website.

Two OTP Types are supported:

• Time-based (TOPT)
• HMAC-based (HOPT)

OTP Fields

This table lists and explains the fields in the OTP Settings dialog.

How to Configure Form Authentication Using an OTP

1. Open Invicti Standard.
2. From the Home tab, click New. The Start a New Website or Web Service Scan dialog is displayed.
3. Click the Form tab. The Form Authentication section is displayed.
4. Check the Enabled checkbox.
5. In the Login Form URL field, enter the URL.
6. In the Username field, enter a username.

7. In the Password field, enter a password. Use the Show/Hide Password button () if required.
8. In the OTP field, click the ellipsis for the relevant persona.

In Form Authentication settings, every persona has its own OTP settings. OTP settings open with default values.

In OTP Settings, If you have a link with a copied otpauth protocol, the settings will be changed automatically based on that link.

The OTP Settings dialog is displayed.

9. In the OTP Type field, select the OTP type.
10. In the Secret Key field, enter the secret key.
11. In the Digit field, select an option.
12. In the Period field, enter an option.
13. In the Algorithm field, select an option.
14. Click Generate OTP. If successful, an OTP is displayed along with a message, ‘OTP generated successfully.’.

15. Click OK to save this OTP for the selected persona.

Configuring Form Authentication Using an OTP from a QR Code

If you don’t have the information you need to complete the fields in the OTP Settings dialog, Invicti can retrieve them from a QR Code. Once the OTP settings are entered, Invicti will attempt to log in automatically. If this type of 2FA information is requested again after the initial login, Invicti will attempt to login automatically.

If Invicti does not automatically find the OTP field, the OTP field can be filled in using Custom Scripts.

For further information, see Custom Scripts for Form Authentication.

How to Configure an OTP from a QR Code

1. Open Invicti Standard.
2. From the Home tab, click New. The Start a New Website or Web Service Scan dialog is displayed.

3. Click the Form tab.
4. Check the Enabled checkbox.

5. In Login Form URL, enter the URL.
6. In the Username field, enter a username.
7. In the Password field, enter a password.
8. In the OTP field, click the ellipsis. The OTP Settings dialog is displayed.
9. Click Read from QR Code. The QR Code Reader dialog is displayed.

10. Click Capture QR Code. Invicti will capture the QR code and configure the settings in the OTP Settings dialog.

Problems with Form Authentication Login

The Invicti Standard form authentication configuration can be configured to use the Interactive Login feature to manually login to websites even when CAPTCHA or a one-time code is required. It also supports custom scripting, so if you have a complex login mechanism (for example, if your website performs several redirects before showing the login page) you can write a script to cater for such a setup. For further information, see Interactive Logins in Invicti Standard.

But if you notice that the scanner still cannot automatically log in and scan the password protected section on your website, open a new support ticket to tell Invicti support what the problem is, so that we can address the issue.

In the meantime, you can use any of these workarounds to scan a password protected website until we fix the issue:

• Use Custom Cookies
• Manual Crawling (Proxy Mode)

Should you encounter any issues with scanning a password that requires authentication please do not hesitate to get in touch with our Support.