Forum Discussion

Alex_Nimo_26616's avatar
Alex_Nimo_26616
Icon for Altocumulus rankAltocumulus
Nov 03, 2018

ASM JSON login page

Hi,   Trying to configure a JSON login page in ASM. The page first asks for the username and only then for the password.   1) When configuring JSON login in ASM, you must supply both the parame...
ASM Advanced WAF
brute force
JSON
login page
security
Alex_Nimo_26616's avatar
Alex_Nimo_26616
Icon for Altocumulus rankAltocumulus
Nov 07, 2018

Those are the 2 Post responses:

 

1 ) Params:

 

2) Params:

 

What links the requests is the cookie and the captcha token but as it can be seen the first request only contains the user and the second one contains the user and the password.

 

  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    Nov 08, 2018

    OK, so you need to configure 2 different login URLs:

     

    1) */authentication/welcome

     

    Username: email

Password: reCaptchaValue

    2) */authentication/sign-in

     

    Username: email

Password: password

    looks like in both cases Response Status code of 200 indicates successful authentication

     

  • Alex_Nimo_26616's avatar
    Alex_Nimo_26616
    Icon for Altocumulus rankAltocumulus
    Nov 11, 2018

    I'll try it

     

    Thanks!