search

Arachni / arachni

Web Application Security Scanner Framework
http://www.arachni-scanner.com
Other
3.77k stars 761 forks source link

autologin:The response did not match the verifier. #967

Open willisfeng opened 6 years ago

willisfeng commented 6 years ago

The response did not match the verifier.

arachni  http://192.168.2.54/login/index  --session-check-url=http://192.168.2.54/login/index     --plugin=autologin:url=http://192.168.2.54/login/tologin,parameters="userName=zk&workerId=9&workerName=zk&wpassword=111&ck_num=11",check="logout" --scope-exclude-pattern=logout  --report-save-path=report.afr --output-debug=2
n_jail'
 [-] [utilities#exception_jail:437] C:/Users/willis/Desktop/arachni/system/ruby/
lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/plugin/manager.rb:68:in `bloc
k in run'
 [-] [utilities#exception_jail:437] C:/Users/willis/Desktop/arachni/system/ruby/
lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/plugin/manager.rb:65:in `each
'
 [-] [utilities#exception_jail:437] C:/Users/willis/Desktop/arachni/system/ruby/
lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/plugin/manager.rb:65:in `run'

 [-] [utilities#exception_jail:437] C:/Users/willis/Desktop/arachni/system/ruby/
lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/framework/parts/state.rb:348:
in `prepare'
 [-] [utilities#exception_jail:437] C:/Users/willis/Desktop/arachni/system/ruby/
lib/ruby/gems/2.2.0/gems/arachni-1.5.1/lib/arachni/framework.rb:110:in `run'
 [-] [utilities#exception_jail:437] C:/Users/willis/Desktop/arachni/system/ruby/
lib/ruby/gems/2.2.0/gems/arachni-1.5.1/ui/cli/framework.rb:80:in `block in run'
 [-] [utilities#exception_jail:438] --------------------------------------------------------------------------------
 [-] [components/plugins/autologin#handle_error:84] AutoLogin: The response did
not match the verifier.
 [~] AutoLogin: Aborting the scan.
 [*] ... done.
 [*] BrowserCluster: Initializing 6 browsers...
 [2018-04-13 13:31:27 +0800 - 0.0] [!!] [browser#start_webdriver:1336] Worker: S
tarting WebDriver...
 [2018-04-13 13:31:27 +0800 - 0.0] [!] [browser#spawn_phantomjs:1227] Worker: Sp
awning PhantomJS...

html code:

<form class="loginForm" id="login_form">
                     <p class="red_color" id="errorArea" style="text-align: center;padding-bottom:4px;color: red">&nbsp;</p>
                        <div class="clearfix w100 nameBox relative">
                            <input type="text" class="w100 inputUserName" id="workerStr" placeholder="请输入员工姓名" datatype="*1-30" name="userName" errormsg="请输入正确的员工姓名" nullmsg="请输入员工姓名" onfocus="getWorkName({thisId:'workerStr',workerId:'workerId',workerName:'workerName',dateType:1,login:true})" class="employe ml_5 w_192"><input type="hidden" name="workerId" id="workerId"><input type="hidden" name="workerName" id="workerName">
                            <div class="Validform_checktip"></div>
                        </div>
                        <div class="clearfix w100 passwordBox relative">
                            <input type="password" class="w100 inputPassword" id="password" placeholder="请输入登录密码" datatype="*1-18" name="wpassword" errormsg="请输入1-18位密码" nullmsg="请输入密码">
                            <div class="Validform_checktip"></div>
                        </div>
                        <div class="clearfix w100 validCodeBox relative">
                            <input type="text" class="fl inputCode" placeholder="请输入验证码" datatype="s" id="ck_num" name="ck_num" errormsg="请输入正确的验证码" nullmsg="请输入验证码">
                            <div class="validImgBox" onclick="javascript:LoadVerifyPic();">
                                <!--验证码的值，改变了记得重新赋值-->
                                <input type="hidden" name="codeVal" value="5998">
                                <img src="/jjslogin/code" id="verify_code" alt="">
                            </div>
                            <div class="Validform_checktip" style="clear:both"></div>
                        </div>
                        <div class="clearfix w100">
                            <input type="hidden" name="needCkNum" id="needCkNum" value="true">
                            <input type="hidden" name="hddid" id="hddid" />
                            <input type="hidden" name="handInfo" id="handInfo">
                            <input name="login" type="button"  class="loginBtn" value="立即登录" id="login_button" onclick="doLogin()"/>
                            <!-- <button class="w100 loginBtn" id="login_button" onclick="doLogin()">立即登录</button> -->
                        </div>
                    </form>
willisfeng commented 6 years ago 
              <input type="text" class="w100 inputUserName" id="workerStr" placeholder="请输入员工姓名" datatype="*1-30" name="userName" errormsg="请输入正确的员工姓名" nullmsg="请输入员工姓名" onfocus="getWorkName({thisId:'workerStr',workerId:'workerId',workerName:'workerName',dateType:1,login:true})" class="employe ml_5 w_192"><input type="hidden" name="workerId" id="workerId"><input type="hidden" name="workerName" id="workerName">
             <input type="password" class="w100 inputPassword" id="password" placeholder="请输入登录密码" datatype="*1-18" name="wpassword" errormsg="请输入1-18位密码" nullmsg="请输入密码">
             <input type="text" class="fl inputCode" placeholder="请输入验证码" datatype="s" id="ck_num" name="ck_num" errormsg="请输入正确的验证码" nullmsg="请输入验证码">
             <input type="hidden" name="codeVal" value="5998">
             <input type="hidden" name="needCkNum" id="needCkNum" value="true">
             <input type="hidden" name="hddid" id="hddid" />
             <input type="hidden" name="handInfo" id="handInfo">
                        <input name="login" type="button"  class="loginBtn" value="立即登录" id="login_button" onclick="doLogin()"/>
Zapotek commented 6 years ago

There seems to have been an error which you only partial included. Any chance you still have it in its entirety?