Skip to main content

Authenticated Scan

Description​

Authenticated Scan is a feature that facilitates security scanning of applications requiring authentication by leveraging cookies and forms. It is compatible with both monolith and microservice architectures, ensuring comprehensive coverage of protected application areas.

note

To use the authentication feature, users must first follow the scanning steps. After that, the user selects the Website Scanner tool because only the Website Scanner tool has the authentication feature. Then, activate the authentication feature by clicking Enabled Authentication, and the Session Cookies and Form will appear. Users can also choose to apply it to monolith or microservice services.

Steps Using Authenticated Scan​

Cookies Capture Form Capture Users can follow the following steps.

  1. Select Service Type, Monolith or Microservice.
  2. Choose penetration method, Session Cookies or Form.
  3. For Session Cookies input, click on the Session Cookies section and complete the fields. Session Cookies is a penetration method that will hijack the browser session stored in the Cookie so that Helium can interact with the website using someone's Session. Users can refer to the provided example.
  4. Enter the URL of a page that can only be accessed after the user has successfully logged in in the URL After Login field.
  5. Enter the URL to perform Logout in the Logout Form URL field.
  6. Enter a unique phrase/word indicating that the user is already on the inner page entered in step 3 in the Login Success Indicator field. This is used as a checking tool to ensure that Helium has successfully entered the page entered in step 3.
  7. Enter a unique phrase/word indicating that the user has not logged in in the Logout Success Indicator field (optional). This is used as a checking tool to ensure that Helium has not logged in.
  8. Enter Cookies in the Cookies field. These cookies must be taken from pages/endpoints protected by authentication. Cookies Capture
  9. Enter Header in the Header field (optional). These Headers must contain values that indicate authorization tokens to access pages protected by authentication and authorization.
  10. For Form input, click on the Form section and complete the fields. Form is a penetration method that will send Login requests with the provided credentials so that Helium can receive authorization permission into the application as if the user manually inputs credentials into the login form. Users can refer to the provided example.
  11. Enter the URL used to send POST requests for application authentication in the Login Form URL field.
  12. Enter the URL of the page location to input credentials on the form for authentication purposes in the Login Page URL field (optional).
  13. Enter the raw value of credentials in Request Payload for authentication purposes in the Login Request Payload field.
  14. Enter the URL to perform logout in the Logout Form URL field.
  15. Enter a unique phrase/word indicating that the user is already on the inner page entered in step 3 in the Login Success Indicator field. This is used as a checking tool to ensure that Helium has successfully entered the page entered in step 3.
  16. Enter a unique phrase/word indicating that the user has not logged in in the Logout Success Indicator field (optional). This is used as a checking tool to ensure that Helium has not logged in.
  17. Enter Cookies in the Cookies field. These cookies must be taken from pages/endpoints protected by authentication. (See Step 8)
  18. Enter Header in the Header field (optional). These Headers must contain values that indicate authorization tokens to access pages protected by authentication and authorization.
  19. Click the Check Authentication button to ensure that the cookie used is valid for testing. Form Capture
  20. If Authentication Success, click the agree Terms of Service checkbox
  21. Click the Start Scan button to start the scan, and click Cancel if you want to cancel