Web application scan utilizing multiple authentication types based on a set of user credentials
In an embodiment, a component of a web application scanner for scanning of a web application obtains a set of user credentials during a scan configuration session, the set of user credentials associated with a plurality of authentication types, and generates a first configuration associated with a first authentication type of the plurality of authentication types based on the set of user credentials. The component performs a first attempt to authenticate the web application scanner with the web application based on the first configuration. The component automatically and selectively performs a second attempt to authenticate the web application scanner using the set of credentials via a different authentication type based on whether the first attempt is verified as successful.
1 . A method of authenticating a web application scanner for scanning of a web application, comprising:
obtaining a set of user credentials during a scan configuration session, the set of user credentials associated with a plurality of authentication types;
generating a first configuration associated with a first authentication type of the plurality of authentication types based on the set of user credentials;
performing a first attempt to authenticate the web application scanner with the web application based on the first configuration;
verifying whether the first attempt is successful; and
automatically and selectively performing a second attempt to authenticate the web application scanner using the set of credentials via a different authentication type based on whether the first attempt is verified as successful.
2 . The method of claim 1 , wherein attempts to authentication via the plurality of authentication types are performed in accordance with an authentication type execution order, until authentication is successful or each authentication type is attempted.
3 . The method of claim 2 , wherein the authentication type execution order is preconfigured or is manually configured by a user.
4 . The method of claim 1 , wherein the set of user credentials comprises:
one or more first credentials associated with a Hypertext Transfer Protocol (HTTP) server authentication mechanism,
one or more second credentials associated with a web application authentication mechanism, or
one or more third credentials associated with a client certificate authentication mechanism, or
a combination thereof.
5 . The method of claim 4 , wherein the set of user credentials includes the one or more first credentials.
6 . The method of claim 5 , wherein the one or more first credentials include a username, a password, a Kerberos domain, a Key Distribution Center (KDC), or a combination thereof.
7 . The method of claim 4 , wherein the set of user credentials includes the one or more second credentials.
8 . The method of claim 7 , wherein the one or more second credentials include a username, a password, a domain, a cookie, an application programming interface (API) key, one or more a Selenium .side file, one or more Hypertext Transfer Protocol (HTTP) headers, or a combination thereof.
9 . The method of claim 4 , wherein the set of user credentials includes the one or more third credentials.
10 . The method of claim 9 , wherein the one or more third credentials include a client certificate, a client certificate private key, a client certificate private key passphrase, or a combination thereof.
11 . The method of claim 1 , wherein the first configuration utilizes less than all user credentials among the set of user credentials.
12 . The method of claim 1 , wherein the automatically and selectively performing comprises:
determining that the first attempt is not verified as successful;
generating a second configuration associated with a second authentication type of the plurality of authentication types based on the set of user credentials;
performing a second attempt to authenticate the web application scanner with the web application based on the second configuration; and
verifying whether the second attempt is successful.
13 . The method of claim 1 , wherein the plurality of authentication types include:
BASIC/DIGEST Hypertext Transfer Protocol (HTTP) server authentication, or
Windows NT Local Area Network (LAN) Manager (NTLM) HTTP server authentication, or
Kerberos HTTP server authentication, or
login form web application authentication, or
cookie web application authentication, or
Selenium web application authentication, or
application programming interface (API) key web application authentication, or
bearer web application authentication, or
client certificate authentication, or
any combination thereof.
14 . A component of a web application scanner for scanning of a web application, comprising:
a memory; and
at least one processor communicatively coupled to the memory, the at least one processor configured to:
obtain a set of user credentials during a scan configuration session, the set of user credentials associated with a plurality of authentication types;
generate a first configuration associated with a first authentication type of the plurality of authentication types based on the set of user credentials;
perform a first attempt to authenticate the web application scanner with the web application based on the first configuration;
verify whether the first attempt is successful; and
automatically and selectively performing a second attempt to authenticate the web application scanner using the set of credentials via a different authentication type based on whether the first attempt is verified as successful.
15 . The component of claim 14 , wherein attempts to authentication via the plurality of authentication types are performed in accordance with an authentication type execution order, until authentication is successful or each authentication type is attempted.
16 . The component of claim 15 , wherein the authentication type execution order is preconfigured or is manually configured by a user.
17 . The component of claim 14 , wherein the set of user credentials comprises:
one or more first credentials associated with a Hypertext Transfer Protocol (HTTP) server authentication mechanism,
one or more second credentials associated with a web application authentication mechanism, or
one or more third credentials associated with a client certificate authentication mechanism, or
a combination thereof.
18 . The component of claim 17 , wherein the set of user credentials includes the one or more first credentials.
19 . The component of claim 18 , wherein the one or more first credentials include a username, a password, a Kerberos domain, a Key Distribution Center (KDC), or a combination thereof.
20 . The component of claim 17 , wherein the set of user credentials includes the one or more second credentials.
21 . The component of claim 20 , wherein the one or more second credentials include a username, a password, a domain, a cookie, an application programming interface (API) key, one or more a Selenium .side file, one or more Hypertext Transfer Protocol (HTTP) headers, or a combination thereof.
22 . The component of claim 17 , wherein the set of user credentials includes the one or more third credentials.
23 . The component of claim 22 , wherein the one or more third credentials include a client certificate, a client certificate private key, a client certificate private key passphrase, or a combination thereof.
24 . The component of claim 14 , wherein the first configuration utilizes less than all user credentials among the set of user credentials.
25 . The component of claim 14 , wherein the automatically and selectively performing comprises:
determine that the first attempt is not verified as successful;
generate a second configuration associated with a second authentication type of the plurality of authentication types based on the set of user credentials;
perform a second attempt to authenticate the web application scanner with the web application based on the second configuration; and
verify whether the second attempt is successful.
26 . The component of claim 14 , wherein the plurality of authentication types include:
BASIC/DIGEST Hypertext Transfer Protocol (HTTP) server authentication, or
Windows NT Local Area Network (LAN) Manager (NTLM) HTTP server authentication, or
Kerberos HTTP server authentication, or
login form web application authentication, or
cookie web application authentication, or
Selenium web application authentication, or
programming interface (API) key web application authentication, or
web application authentication, or
client certificate authentication, or
any combination thereof.
27 . A non-transitory computer-readable medium storing computer-executable instructions that, when executed by a component of a web application scanner for scanning of a web application, cause the component to:
obtain a set of user credentials during a scan configuration session, the set of user credentials associated with a plurality of authentication types;
generate a first configuration associated with a first authentication type of the plurality of authentication types based on the set of user credentials;
perform a first attempt to authenticate the web application scanner with the web application based on the first configuration;
verify whether the first attempt is successful; and
automatically and selectively performing a second attempt to authenticate the web application scanner using the set of credentials via a different authentication type based on whether the first attempt is verified as successful.
28 . The non-transitory computer-readable medium of claim 27 , wherein attempts to authentication via the plurality of authentication types are performed in accordance with an authentication type execution order, until authentication is successful or each authentication type is attempted.
29 . The non-transitory computer-readable medium of claim 28 , wherein the authentication type execution order is preconfigured or is manually configured by a user.
30 . The non-transitory computer-readable medium of claim 27 , wherein the set of user credentials comprises:
one or more first credentials associated with a Hypertext Transfer Protocol (HTTP) server authentication mechanism,
one or more second credentials associated with a web application authentication mechanism, or
one or more third credentials associated with a client certificate authentication mechanism, or
a combination thereof.
31 . The non-transitory computer-readable medium of claim 30 , wherein the set of user credentials includes the one or more first credentials.
32 . The non-transitory computer-readable medium of claim 31 , wherein the one or more first credentials include a username, a password, a Kerberos domain, a Key Distribution Center (KDC), or a combination thereof.
33 . The non-transitory computer-readable medium of claim 30 , wherein the set of user credentials includes the one or more second credentials.
34 . The non-transitory computer-readable medium of claim 33 , wherein the one or more second credentials include a username, a password, a domain, a cookie, an application programming interface (API) key, one or more a Selenium .side file, one or more Hypertext Transfer Protocol (HTTP) headers, or a combination thereof.
35 . The non-transitory computer-readable medium of claim 30 , wherein the set of user credentials includes the one or more third credentials.
36 . The non-transitory computer-readable medium of claim 35 , wherein the one or more third credentials include a client certificate, a client certificate private key, a client certificate private key passphrase, or a combination thereof.
37 . The non-transitory computer-readable medium of claim 27 , wherein the first configuration utilizes less than all user credentials among the set of user credentials.
38 . The non-transitory computer-readable medium of claim 27 , wherein the automatically and selectively performing comprises:
determine that the first attempt is not verified as successful;
generate a second configuration associated with a second authentication type of the plurality of authentication types based on the set of user credentials;
perform a second attempt to authenticate the web application scanner with the web application based on the second configuration; and
verify whether the second attempt is successful.
39 . The non-transitory computer-readable medium of claim 27 , wherein the plurality of authentication types include:
BASIC/DIGEST Hypertext Transfer Protocol (HTTP) server authentication, or
Windows NT Local Area Network (LAN) Manager (NTLM) HTTP server authentication, or
Kerberos HTTP server authentication, or
login form web application authentication, or
cookie web application authentication, or
Selenium web application authentication, or
programming interface (API) key web application authentication, or
web application authentication, or
client certificate authentication, or
any combination thereof.