Web Authentication Credentials

Name

(Required) A name for the credential.

Description

A description for the credential.

Tag

A tag for the credential. For more information, see Tags.

Client Certificate

The file that contains the PEM-formatted certificate used to communicate with the host.

Client Certificate Private Key

The file that contains the PEM-formatted private key for the client certificate.

Client Certificate Private Key Passphrase

The passphrase for the private key, if required.

Page to Verify Successful Authentication

The URL that Tenable Security Center can access to validate the authenticated session.

Pattern to Verify Successful Authentication

A word, phrase, or regular expression that appears on the website only if the authentication is successful (for example, Welcome, your username!). Leading slashes are escaped and .* is not required at the beginning or end of the pattern.

Username

(Required) The username that Tenable Security Center uses to authenticate to the HTTP server.

Password

(Required) The password that Tenable Security Center uses to authenticate to the HTTP server.

Authentication Type

The method used to authenticate to the HTTP server:

• Basic/Digest

• NTLM

• Kerberos

Kerberos Realm

Authentication Method

The method used to authenticate to the HTTP server:

• Login Form

• Cookie Authentication

• API Key

• Selenium Authentication

• Bearer Authentication

Login Page

The URL of the login page for the web application you want to scan.

Login Parameters

For each field in the target's login form (for example, username, password, domain, etc.) enter one login parameter in each row:

1. In the left box, type the login field's name or id HTML DOM attribute.

2. In the right box, type the value to insert in that text field at login.

3. (Optional) Click Add to add additional login parameters.

Pattern to Verify Successful Auth

A word, phrase, or regular expression that appears on the website only if the authentication is successful (for example, Welcome, your username). Note that leading slashes are escaped and .* is not required at the beginning or end of the pattern.

Page to Verify Active Session

The URL that Tenable Security Center can continually access to validate the authenticated session.

Pattern to Verify Active Session

A word, phrase, or regular expression that appears on the website only if the session is still active (for example, Hello, your username). Note that leading slashes are escaped and .* is not required at the beginning or end of the pattern.

Enter one cookie authentication credential in each row:

1. In the left box, type the name of the cookie authentication credential.

2. In the right box, type the value of the cookie authentication credential.

3. (Optional) Click Add to add additional cookie authentication credentials.

Page to Verify Active Session

A word, phrase, or regular expression that appears on the website only if the session is still active (for example, Hello, your username). Note that leading slashes are escaped and .* is not required at the beginning or end of the pattern.

Enter one HTTP header in each row:

1. In the left box, type the name of the HTTP header.

2. In the right box, type the value of the HTTP header.

3. (Optional) Click Add to add additional headers.

A word, phrase, or regular expression that appears on the website only if the session is still active (for example, Hello, your username). Note that leading slashes are escaped and .* is not required at the beginning or end of the pattern.

Use the following steps to add a .side file:

1. In the Selenium IDE extension, record your authentication credentials.

2. Click Add File.

   The file manager for your operating system appears.

3. Navigate to and select your Selenium credentials .side file.

   Tenable Security Center imports the credentials file.

A word, phrase, or regular expression that appears on the website only if the session is still active (for example, Hello, your username). Note that leading slashes are escaped and .* is not required at the beginning or end of the pattern.

A word, phrase, or regular expression that appears on the website only if the session is still active (for example, Hello, your username). Note that leading slashes are escaped and .* is not required at the beginning or end of the pattern.