All Collections
Quick how to's!
Authentication
How to set up Target Authentication (Login Sequence)
How to set up Target Authentication (Login Sequence)

How to configure Probely to scan behind your target's login page?

Ana Pascoal avatar
Written by Ana Pascoal
Updated over a week ago

The first step to a well-secured Web Application is a sound authentication system. This keeps intruders from accessing your sensitive information and makes your systems overall safer.

If you have Authentication set up on your target, you might want Probely to scan your website further behind the login page, like an authenticated user. By doing this, you're enabling Probely to run a scan that might reveal any vulnerabilities in deeper parts of your app.

It is recommended that you create a user for the tests since Probely will submit forms and click buttons, which might "pollute" the account.

After you've added a successfully verified target, you can head to the target settings and follow these steps:

Step 1: Go to your target Settings

On your target settings, go to the AUTHENTICATION tab, locate the LOGIN CONFIGURATION section, and expand LOGIN SEQUENCE:

Step 2: Import your login sequence

Click on Add Login Sequence and, on the next screen, define a name and either paste or upload a previously recorded login sequence; if you haven’t recorded a sequence yet, here’s how you can do it:

First, start by making sure you are logged out of your target. Then, input your target’s URL on Probely’s plugin and Start recording. If the login URL is https://example.com/login, make sure to input the https://example.com/ URL and click on the necessary link/button to access the login page, as if simulating a user’s action; alternatively, wait for your target to redirect you automatically to the login page, if applicable.

Once you are on your target’s login page, fill in the necessary fields in order to log in. If your credentials are already saved and automatically filled in by your browser, make sure to use your mouse to click on each field so that the plugin can record the necessary fields and their values.

After filling in the necessary fields, make sure to click on the login button or follow any steps needed to conclude the login process and access your target. Make sure to use your mouse cursor as much as possible so that each action you make within your page is correctly registered by the plugin.

Once you are logged in to your target, Stop recording and either copy or download your login sequence and import it to your target settings right away!

Step 3: Once you are done, submit your sequence and click on Save

You can now run authenticated scans on your target!

Read the following articles to learn more about other authentication schemes for your targets:

Did this answer your question?