1

I have scanned my website using Nessus. But I need to scan it as a logged in user since most of the URLs are accessible only if we are logged in. How can I set website login credentials in Nessus?

Harikrishnan
  • 452
  • 1
  • 5
  • 18
  • Login mechanisms differs from site to site, can't you just disable the login mechanism or make an auto-login from a certain IP? [Otherwise try your favorite search engine](https://www.google.com/search?q=nessus+scan+website+with+credentials) – HamZa Apr 30 '14 at 10:08
  • I have searched in google before asking here..didn't get solution..'Scaning by login mechanism disabled' seems good idea..Will check that... – Harikrishnan Apr 30 '14 at 17:00

3 Answers3

2

Nessus has the information posted on their page with a full walk through. http://www.tenable.com/tips/how-to-enable-credentialed-checks-on-windows

munkeyoto
  • 8,682
  • 16
  • 31
2

Nessus 5 made a change: It's in the Preferences section:

  • Login configurations
  • HTTP login page

There you can set your HTTP credentials/settings.

This is a basic check in the documentation. Why go Google, when you can RTFM....

schroeder
  • 123,438
  • 55
  • 284
  • 319
1

There are two ways:

  • Cookie import: First you have to export them from your browser in netscape format. Read more here

  • Http Login Parameters: An article demonstrating this option is here.

    Moreover, the steps as described in the documentation are the following:

    1. Create new scan
    2. Web Application Tests

    3. Credentials: which are filled out like these (taken from documentation):

      • Username: Login user’s name.
      • Password: Password of the user specified.

      • Login page: The absolute path to the login page of the application, e.g., /login.html

      • Login submission page: The action parameter for the form method. For example, the login form for: would be: /login.php

      • Login parameters: Specify the authentication parameters (e.g., login=%USER%&password=%PASS%). If the keywords %USER% and %PASS% are used, they will be substituted with values supplied on the Login configurations drop-down menu. This field can be used to provide more than two parameters if required (e.g., a group name or some other piece of information is required for the authentication process).

      • Check authentication on page: The absolute path of a protected web page that requires authentication, to better assist Nessus in determining authentication status, e.g., /admin.html.

      • Regex to verify successful authentication: A regex pattern to look for on the login page. Simply receiving a 200 response code is not always sufficient to determine session state. Nessus can attempt to match a given string such as Authentication successful

However, in my case (drupal 6), it couldn't authenticate

chefarov
  • 154
  • 1
  • 10