Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Authentication in Meteor WebApp

John | Last updated: Dec 20, 2017 05:41AM UTC

Hello, I have a Meteor based web application that uses Meteor's `accounts-ui` and `accounts-password` packages for login/authentication handling. I've been following this tutorial to get the point-and-click scanner functionality running but with no luck: https://portswigger.net/burp/help/scanner_pointandclick in getting a successful login. Specifically, I have attempted to use both Spider -> Options -> Application Login settings and Spider -> Options -> Form Submission (by adding a regex for the email/password html inputs with appropriate values). However, via logs within my application, I don't see any successful logins. What could the issue be? Thanks!

PortSwigger Agent | Last updated: Dec 20, 2017 11:25AM UTC

Hi John, Thanks for your message. Spider only supports regular HTML forms. If Meteor uses Ajax or WebSockets for the login then Spider won't be able to work with that. For applications like this you usually need to do a manual crawl, although you should still be able to use Scanner. Please let us know if you need any further assistance.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.