This is an informational notice that the scanner was able to find the authentication check pattern using an unauthenticated browser. This indicates that the scanner cannot validate if authentication was successful.

The scanner detected the presence of a web page protected by a 'Digest' authentication.

The scanner detected the presence of a web page protected by a 'NTLM' authentication.

The scanner detected the presence of a web page protected by a 'Bearer' authentication.

This plugin is raised when the scanner has not been able to authenticate against the web application using the client certificate authentication credentials provided in the scan policy.

Check the output of the plugin to get an explanation of the issue encountered by the scan.

This is an informational notice that the scanner was able to successfully authenticate against the web application using the client certificate authentication credentials provided in the scan policy.

This plugin is raised when the scanner has not been able to authenticate against the web application using the Kerberos authentication credentials provided in the scan policy.

Check the output of the plugin to get an explanation of the issue encountered by the scan.

This is an informational notice that the scanner was able to successfully authenticate against the web application using the Kerberos authentication credentials provided in the scan policy.

The scanner successfully authenticated on the Weblogic console by using weak or predictable credentials.

The scanner successfully authenticated on the Drupal administration panel by using weak or predictable credentials.

The scanner successfully authenticated on the Wordpress administration panel by using weak or predictable credentials.

The scanner successfully authenticated on the Joomla administration panel by using weak or predictable credentials.

The scanner successfully authenticated on the Magento connect manager by using weak or predictable credentials.

The scanner successfully authenticated on the Magento administration panel by using weak or predictable credentials.

The scanner successfully authenticated on the target Apache Tomcat manager interface by using weak or predictable credentials.

The scanner successfully authenticated on the target web application by using weak credentials in the request basic authentication HTTP header.

The scanner detected the presence of a web page protected by a 'Basic' authentication.

The scanner successfully authenticated on the target web application by using predictable credentials on its login form.

This plugin is raised when the scanner has not been able to authenticate against the web application using the bearer authentication credentials provided in the scan policy.

Check the output of the plugin to get an explanation of the issue encountered by the scan.

This is an informational notice that the scanner was able to successfully authenticate against the web application using the bearer authentication credentials provided in the scan policy.

This plugin is raised when the scanner has not been able to authenticate against the web application using the API key credentials provided in the scan policy.

Check the output of the plugin to get an explanation of the issue encountered by the scan.

This is an informational notice that the scanner was able to successfully authenticate against the web application using the API key credentials provided in the scan policy.

Web applications use sessions to retain information about each user, keep track of their activity or define proper access rights and permissions. Each session has an identifier (token or ID) defined by the application to bind users to their HTTP traffic, being temporarily equivalent to the strongest authentication method used by the application for authenticated sessions.

URLs are often used to exchange information between the user and the application and may sometimes include session tokens. As URLs can be logged or disclosed in various locations (like proxy and server web logs, referer HTTP header...), sensitive session tokens could be leaked and used by malicious actors to try to conduct session fixation or hijacking attacks.

The scanner collected the session cookies returned by the application during an authenticated scan. The list includes the following information for each cookie:
 - Name: name of the cookie
 - Value: value of the cookie
 - Domain: hosts to which the cookie will be sent
 - Path: URL path which must exist in the requested resource before sending the cookie
 - HttpOnly: cookie is set to be not accessible via JavaScript, XMLHttpRequest and Request APIs
 - Secure: cookie will be sent to the server only when a request is made using HTTPS
 - SameSite: cookie will be sent along with cross-site request according the defined policy
 - URL: first URL discovered which set the cookie in its response
 - Set-Method: method used by the application to set the cookie (Set-Cookie or JavaScript)

A web session is a set of HTTP transactions issued by a user within a given time frame. Web applications use sessions to retain information about each user, keep track of their activity or define proper access rights and permissions. Each session has an identifier (token or ID) defined by the application to bind users to their HTTP traffic, being temporarily equivalent to the strongest authentication method used by the application for authenticated sessions.

By targeting the session management mechanism, attackers can hijack other users sessions to impersonate these users and use their privileges in the application or access sensitive information.

The remote web server contains web pages that are protected by 'Basic' authentication over cleartext.

An attacker eavesdropping the traffic might obtain logins and passwords of valid users.

This plugin is raised when the scanner has been logged out and has not been able to authenticate back against the web application using the options provided in the scan policy. This may be due to some links accessed by the scanner during the scan that could have invalidated the session used by the scanner, or even have altered the account used for the authentication.

Check the output of the plugin for more details of the issue encountered by the scan.

This plugin is raised when the scanner detected that it has been logged out during the scan, but has been able to authenticate back against the web application using the options provided in the scan policy. Such case may occur if the scanner accesses a link that led the session to be closed.

Check the output of the plugin for more details of the issue encountered by the scan.

This is an informational notice that the scanner identified a potential login form that could be used by the scanner to authenticate and have access to additional pages for extending its coverage.

This plugin is raised when the scanner has not been able to authenticate against the web server to access pages protected by HTTP server authentication. Check the output of the plugin to get an explanation of the issue encountered by the scan.

This is an informational notice that the scanner was able to successfully authenticate against the web server using HTTP server credentials provided in the scan policy.

This is an informational notice that the scanner identified pages protected by web server using HTTP server authentication. Check plugin output to gather more information regarding type of authentication set, and attachment to know which URLs require authenticated access.

This plugin is raised when the scanner has not been able to authenticate against the web application using the Selenium script provided in the scan policy.

Check the output of the plugin to get an explanation of the issue encountered by the scan.

This is an informational notice that the scanner was able to successfully authenticate against the web application using the Selenium script provided in the scan policy.

This plugin is raised when the scanner has not been able to authenticate against the web application using the cookies provided in the scan policy.

Check the output of the plugin to get an explanation of the issue encountered by the scan.

This is an informational notice that the scanner was able to successfully authenticate against the web application using the cookies provided in the scan policy.

This is an informational notice that the scanner was able to successfully authenticate against the web application using the login form credentials provided in the scan policy.

HTTP by itself is a stateless protocol; therefore, the server is unable to determine which requests are performed by which client and which clients are authenticated or unauthenticated.

The use of HTTP cookies within the headers allows a web server to identify each individual client and can thus determine which clients hold valid authentication from those that do not. These are known as session cookies or session tokens.

To prevent clients from being able to guess each other's session token, each assigned session token should be entirely random and be different whenever a session is established with the server.

Session fixation occurs when the client is able to specify their own session token value and the value of the session cookie is not changed by the server after successful authentication. Occasionally, the session token will also remain unchanged for the user independently of how many times they have authenticated.

Cyber-criminals will abuse this functionality by sending crafted URL links with a predetermined session token within the link. The cyber-criminal will then wait for the victim to login and become authenticated. If successful, the cyber-criminal will know a valid session ID and therefore have access to the victim's session.

Scanner has discovered that it is able to set its own session token.

Origin headers are utilised by proxies and/or load balancers to track the originating IP address of the client.

As the request progresses through a proxy, the origin header is added to the existing headers, and the value of the client's IP is then set within this header. Occasionally, poorly implemented access restrictions are based off of the originating IP address alone.

For example, any public IP address may be forced to authenticate, while an internal IP address may not.

Because this header can also be set by the client, it allows cyber-criminals to spoof their IP address and potentially gain access to restricted pages.

Scanner discovered a resource that it did not have permission to access, but been granted access after spoofing the address of localhost (127.0.0.1), thus bypassing any requirement to authenticate.

The HTTP protocol by itself is clear text, meaning that any data that is transmitted via HTTP can be captured and the contents viewed.

To keep data private, and prevent it from being intercepted, HTTP is often tunnelled through either Secure Sockets Layer (SSL), or Transport Layer Security (TLS). When either of these encryption standards are used it is referred to as HTTPS.

Cyber-criminals will often attempt to compromise credentials passed from the client to the server using HTTP. This can be conducted via various different Man-in-The-Middle (MiTM) attacks or through network packet captures.

Scanner discovered that the affected page contains a `password` input, however, the value of the field is not sent to the server utilising HTTPS. Therefore it is possible that any submitted credential may become compromised.

In typical form-based web applications, it is common practice for developers to allow `autocomplete` within the HTML form to improve the usability of the page. With `autocomplete` enabled (default), the browser is allowed to cache previously entered form values.

For legitimate purposes, this allows the user to quickly re-enter the same data when completing the form multiple times.

When `autocomplete` is enabled on either/both the username and password fields, this could allow a cyber-criminal with access to the victim's computer the ability to have the victim's credentials automatically entered as the cyber-criminal visits the affected page.

Scanner has discovered that the affected page contains a form containing a password field that has not disabled `autocomplete`.

This plugin is raised when the scanner has not been able to authenticate against the web application using the login form credentials provided in the scan policy.

Check the output of the plugin to get an explanation of the issue encountered by the scan.

ID	Name	Severity
114247	Authentication Check Pattern Found in Unauthenticated Browser	info
114138	Digest Authentication Detected	info
114137	NTLM Authentication Detected	info
114136	Bearer Token Authentication Detected	info
113330	Client Certificate Authentication Failed	info
113329	Client Certificate Authentication Succeeded	info
113225	Kerberos Authentication Failed	info
113224	Kerberos Authentication Succeeded	info
113138	Weblogic Console Login Form Bruteforced	high
113137	Drupal Administration Panel Login Form Bruteforced	high
113136	Wordpress Administration Panel Login Form Bruteforced	high
113133	Joomla Administration Panel Login Form Bruteforced	high
113118	Magento Connect Manager Bruteforced	high
113117	Magento Administration Panel Login Form Bruteforced	high
113114	Apache Tomcat Manager Bruteforced	high
113067	Basic Authentication Bruteforced	high
113063	Basic Authentication Detected	info
98042	Login Form Bruteforced	high
113013	Bearer Token Authentication Failed	info
113012	Bearer Token Authentication Succeeded	info
113011	API Key Authentication Failed	info
113010	API Key Authentication Succeeded	info
112799	Exposed Session Token	medium
112798	Session Cookies Detected	info
112794	Weak Session Management Detected	high
98615	Basic Authentication Without HTTPS	low
98044	Scan Aborted After Being Logged Out	info
98043	Scan Logged-out Intermittently	info
98033	Login Form Detected	info
98026	HTTP Server Authentication Failed	info
98025	HTTP Server Authentication Succeeded	info
98024	HTTP Server Authentication Detected	info
98142	Selenium Authentication Failed	info
98141	Selenium Authentication Succeeded	info
98140	Cookie Authentication Failed	info
98139	Cookie Authentication Succeeded	info
98035	Login Form Authentication Succeeded	info
98102	Session Fixation	medium
98096	Access Restriction Bypass Via Origin Spoof	medium
98082	Unencrypted Password Form	medium
98081	Password Field With Auto-Complete	low
98034	Login Form Authentication Failed	info

Detections

Analytics

Authentication & Session Family for Web App Scanning

info

info

info

info

info

info

info

info

high

high

high

high

high

high

high

high

info

high

info

info

info

info

medium

info

high

low

info

info

info

info

info

info

info

info

info

info

info

medium

medium

medium

low

info