配置扫描认证| InsightAppSec文档据/标题>据关联href=“//www.gcpym.com/areas/docs/includes/dist/app.css?15f7280702176ccedf1d" rel="stylesheet"> </head> <body> <div id="r7-global-nav"> <div id="react_0HMBM66V3BCCJ"> <header class="r7-nav mobile"> <section class="search-bar search-bar--mobile hide animate-out"> <form action="/search"> <div class="container flex flex-jc-c flex-ai-c"> <div class="search-content flex flex-jc-fs flex-ai-c"> <i class="r7-icon r7-icon-search-magnify"></i> <input type="search" class="search-input" name="q" placeholder="Search"> <input type="submit" class="search-submit button blue" value="搜索“>据input type="hidden" name="filters" value="productname\u InsightAppSec“>据a id="btnSearchCloseMobile" class="search-close"><i class="r7-icon r7-icon-delete-x"></i></a> </div> </div> </form> </section> <div class="search-overlay search-overlay--mobile overlay "></div> <nav class="main-nav "> <div class="container flex flex-jc-sb flex-ai-c"> <div class="flex flex-jc-c flex-ai-c"> <a class="main-nav__toggle"><i class="r7-icon text-white"></i></a> </div> <a class="main-nav__logo flex flex-jc-c flex-ai-c text-center" href="https://www.rapid7.com/" target="_blank"><img src="//www.gcpym.com/Areas/Docs/includes/img/r7-nav/Rapid7_logo.svg" alt="Rapid7之家“></a> <a class="search flex flex-jc-c flex-ai-c"><i class="r7-icon r7-icon-search-magnify text-white"></i></a> </div> <div class="main-nav__links flex flex-jc-c"> <ul> <li class="main-nav__link dropdown "><a class="dropdown-trigger has-toggle" href="https://www.rapid7.com/products/">产品据/a> <div class="dropdown-content two-col"> <ul class="dropdown-menu"> <li class="dropdown-title">了解解决方案据/li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/insightidr/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('/Areas/Docs/includes/img/r7-nav/icon-cloud.svg')"></div> <div class="dropdown-text"> Insightidr.据div class="dropdown-category"> 用户行为分析与SIEM据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/insightvm/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('/Areas/Docs/includes/img/r7-nav/icon-cloud.svg')"></div> <div class="dropdown-text"> InsightVM据div class="dropdown-category"> 脆弱性管理据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/insightappsec/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('/Areas/Docs/includes/img/r7-nav/icon-cloud.svg')"></div> <div class="dropdown-text"> InsightAppSec据div class="dropdown-category"> 动态应用安全测试据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/insightconnect/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('/Areas/Docs/includes/img/r7-nav/icon-cloud.svg')"></div> <div class="dropdown-text"> Insightconnect.据div class="dropdown-category"> 管弦乐流与自动化据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/insightops/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('/Areas/Docs/includes/img/r7-nav/icon-cloud.svg')"></div> <div class="dropdown-text"> Insigrops.据div class="dropdown-category"> 日志管理据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/insightcloudsec/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('/Areas/Docs/includes/img/r7-nav/icon-cloud.svg')"></div> <div class="dropdown-text"> InsightCloudSec据div class="dropdown-category"> 云安全据/div> </div></a></li> </ul> <ul class="dropdown-menu"> <li class="dropdown-title">更多的解决方案据/li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/metasploit/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-report.svg')"></div> <div class="dropdown-text"> metasploit.据div class="dropdown-category"> 渗透测试据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/nexpose/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-report.svg')"></div> <div class="dropdown-text"> nexpose据div class="dropdown-category"> 漏洞管理本地据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/tcell/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-report.svg')"></div> <div class="dropdown-text"> Tcell by Rapid7.据div class="dropdown-category"> 应用监控与保护据/div> </div></a></li> </ul> <div class="dropdown-view-all flex flex-jc-sb flex-ai-c"> <a href="https://www.rapid7.com/products/insight-platform/">dota2必威联赛</a> <a href="https://www.rapid7.com/try/insight/" class="button blue">免费试用据/a> </div> </div></li> <li class="main-nav__link dropdown "><a class="dropdown-trigger has-toggle" href="https://www.rapid7.com/services/">服务据/a> <div class="dropdown-content true"> <ul class="dropdown-menu"> <li class="dropdown-title">服务据/li> <li class="dropdown-item"><a href="https://www.rapid7.com/services/managed-services/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-diamond-person.svg')"></div> <div class="dropdown-text"> 管理服务据div class="dropdown-category"> 运营，评估和报告据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/services/security-consulting/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-shield.svg')"></div> <div class="dropdown-text"> 安全咨询据div class="dropdown-category"> 评估，测试和响应据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/services/product-consulting/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-report.svg')"></div> <div class="dropdown-text"> 产品咨询据div class="dropdown-category"> 快速启动和配置据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/services/training-certification/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-book-open.svg')"></div> <div class="dropdown-text"> 培训和认证据div class="dropdown-category"> 技能和发展据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/services/support-and-customer-success/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/user-customer-service-call.svg')"></div> <div class="dropdown-text"> 客户成功据div class="dropdown-category"> 一站式支持中心据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/services/premium-support/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/premium-support-icon.svg')"></div> <div class="dropdown-text"> 高级支持据div class="dropdown-category"> 优先帮助和更快的解决方案据/div> </div></a></li> </ul> </div></li> <li class="main-nav__link dropdown "><a class="dropdown-trigger has-toggle" href="">支持与资源据/a> <div class="dropdown-content two-col"> <ul class="dropdown-menu"> <li class="dropdown-title">支持据/li> <li class="dropdown-item"><a href="https://www.rapid7.com/for-customers/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-monitor.svg')"></div> <div class="dropdown-text"> 支持门户网站据div class="dropdown-category"> 联系客户支持据/div> </div></a></li> <li class="dropdown-item"><a href="//www.gcpym.com/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-notes.svg')"></div> <div class="dropdown-text"> 产品文档据div class="dropdown-category"> 浏览产品指南据/div> </div></a></li> <li class="dropdown-item"><a href="//www.gcpym.com/release-notes/" class="has-icon">365必威 </a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/contact/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-envelope-email-checked-okay.svg')"></div> <div class="dropdown-text"> 联系我们据div class="dropdown-category"> 跟销售据/div> </div></a></li> </ul> <ul class="dropdown-menu"> <li class="dropdown-title">资源据/li> <li class="dropdown-item"><a href="https://www.rapid7.com/fundamentals/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-book-open.svg')"></div> <div class="dropdown-text"> 基础知识据div class="dropdown-category"> 基础安全知识据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/blog/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-signal-wifi.svg')"></div> <div class="dropdown-text"> 博客据div class="dropdown-category"> 最新的行业新闻和安全专业知识据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/resources/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-note-authenticate.svg')"></div> <div class="dropdown-text"> 资源库据div class="dropdown-category"> 电子书、白皮书、视频和简报据/div> </div></a></li> <li class="dropdown-item"><a href="https://extensions.rapid7.com/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-plug-outlet-collection.svg')"></div> <div class="dropdown-text"> 扩展库据div class="dropdown-category"> 插件，集成和开发者社区据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/partners/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-partners.svg')"></div> <div class="dropdown-text"> 合作伙伴据div class="dropdown-category"> Rapid7合作伙伴生态系统据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/about/events-webcasts/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-community-users.svg')"></div> <div class="dropdown-text"> 网络广播和事件据div class="dropdown-category"> 即将到来的机会与我们联系据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/db/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-vulnerability.svg')"></div> <div class="dropdown-text"> 漏洞与利用数据库据div class="dropdown-category"> 搜索最新的安全研究必威体育西汉姆联官网据/div> </div></a></li> </ul> </div></li> <li class="main-nav__link "><a class="" href="https://www.rapid7.com/research/">必威体育西汉姆联官网</a></li> <li class="main-nav__link"><a href="https://insight.rapid7.com/saml/SSO" class="has-icon"><img src="//www.gcpym.com/Areas/Docs/includes/img/r7-nav/icon-lock.svg"> 登录据/a></li> </ul> </div> </nav> <nav class="sub-nav container flex flex-ai-c"> <div class="sub-nav__title"> <a href="//www.gcpym.com/">文件据/a> </div> <ul> <li class="sub-nav__link dropdown "><a class="dropdown-trigger has-toggle">InsightAppSec据/a> <div class="dropdown-content"> <ul class="dropdown-menu"> <li class="dropdown-item"><a href="//www.gcpym.com/appspider/">appspider.据/a></li> <li class="dropdown-item"><a href="//www.gcpym.com/insight-agent/">必威体育app登录</a></li> <li class="dropdown-item"><a href="//www.gcpym.com/insightappsec/">2020刀塔必威赛事 </a></li> <li class="dropdown-item"><a href="//www.gcpym.com/insightidr/">Insightidr.据/a></li> <li class="dropdown-item"><a href="//www.gcpym.com/sensor/">洞察网络传感器据/a></li> <li class="dropdown-item"><a href="//www.gcpym.com/insightops/">Insigrops.据/a></li> <li class="dropdown-item"><a href="//www.gcpym.com/insightvm/">InsightVM据/a></li> <li class="dropdown-item"><a href="//www.gcpym.com/metasploit/">metasploit.据/a></li> <li class="dropdown-item"><a href="//www.gcpym.com/nexpose/">nexpose据/a></li> <li class="dropdown-item"><a href="//www.gcpym.com/tcell/">tCell据/a></li> <li class="dropdown-item"><a href="//www.gcpym.com/services/">Rapid7服务据/a></li> </ul> </div></li> </ul> </nav> </header> <div class="dropdown-overlay overlay false"></div> <header class="r7-nav"> <nav class="main-nav"> <div class="container flex flex-jc-sb flex-ai-c"> <div class="main-nav__logo"> <a class="flex" href="https://www.rapid7.com/" target="_blank"><img src="//www.gcpym.com/Areas/Docs/includes/img/r7-nav/Rapid7_logo.svg" alt="Rapid7之家“></a> </div> <div class="main-nav__links flex flex-jc-c"> <ul> <li class="main-nav__link dropdown "><a class="dropdown-trigger has-toggle" href="https://www.rapid7.com/products/">产品据/a> <div class="dropdown-content two-col"> <ul class="dropdown-menu"> <li class="dropdown-title">了解解决方案据/li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/insightidr/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('/Areas/Docs/includes/img/r7-nav/icon-cloud.svg')"></div> <div class="dropdown-text"> Insightidr.据div class="dropdown-category"> 用户行为分析与SIEM据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/insightvm/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('/Areas/Docs/includes/img/r7-nav/icon-cloud.svg')"></div> <div class="dropdown-text"> InsightVM据div class="dropdown-category"> 脆弱性管理据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/insightappsec/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('/Areas/Docs/includes/img/r7-nav/icon-cloud.svg')"></div> <div class="dropdown-text"> InsightAppSec据div class="dropdown-category"> 动态应用安全测试据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/insightconnect/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('/Areas/Docs/includes/img/r7-nav/icon-cloud.svg')"></div> <div class="dropdown-text"> Insightconnect.据div class="dropdown-category"> 管弦乐流与自动化据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/insightops/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('/Areas/Docs/includes/img/r7-nav/icon-cloud.svg')"></div> <div class="dropdown-text"> Insigrops.据div class="dropdown-category"> 日志管理据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/insightcloudsec/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('/Areas/Docs/includes/img/r7-nav/icon-cloud.svg')"></div> <div class="dropdown-text"> InsightCloudSec据div class="dropdown-category"> 云安全据/div> </div></a></li> </ul> <ul class="dropdown-menu"> <li class="dropdown-title">更多的解决方案据/li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/metasploit/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-report.svg')"></div> <div class="dropdown-text"> metasploit.据div class="dropdown-category"> 渗透测试据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/nexpose/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-report.svg')"></div> <div class="dropdown-text"> nexpose据div class="dropdown-category"> 漏洞管理本地据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/products/tcell/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-report.svg')"></div> <div class="dropdown-text"> Tcell by Rapid7.据div class="dropdown-category"> 应用监控与保护据/div> </div></a></li> </ul> <div class="dropdown-view-all flex flex-jc-sb flex-ai-c"> <a href="https://www.rapid7.com/products/insight-platform/">dota2必威联赛</a> <a href="https://www.rapid7.com/try/insight/" class="button blue">免费试用据/a> </div> </div></li> <li class="main-nav__link dropdown "><a class="dropdown-trigger has-toggle" href="https://www.rapid7.com/services/">服务据/a> <div class="dropdown-content true"> <ul class="dropdown-menu"> <li class="dropdown-title">服务据/li> <li class="dropdown-item"><a href="https://www.rapid7.com/services/managed-services/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-diamond-person.svg')"></div> <div class="dropdown-text"> 管理服务据div class="dropdown-category"> 运营，评估和报告据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/services/security-consulting/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-shield.svg')"></div> <div class="dropdown-text"> 安全咨询据div class="dropdown-category"> 评估，测试和响应据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/services/product-consulting/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-report.svg')"></div> <div class="dropdown-text"> 产品咨询据div class="dropdown-category"> 快速启动和配置据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/services/training-certification/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-book-open.svg')"></div> <div class="dropdown-text"> 培训和认证据div class="dropdown-category"> 技能和发展据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/services/support-and-customer-success/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/user-customer-service-call.svg')"></div> <div class="dropdown-text"> 客户成功据div class="dropdown-category"> 一站式支持中心据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/services/premium-support/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/premium-support-icon.svg')"></div> <div class="dropdown-text"> 高级支持据div class="dropdown-category"> 优先帮助和更快的解决方案据/div> </div></a></li> </ul> </div></li> <li class="main-nav__link dropdown "><a class="dropdown-trigger has-toggle" href="">支持与资源据/a> <div class="dropdown-content two-col"> <ul class="dropdown-menu"> <li class="dropdown-title">支持据/li> <li class="dropdown-item"><a href="https://www.rapid7.com/for-customers/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-monitor.svg')"></div> <div class="dropdown-text"> 支持门户网站据div class="dropdown-category"> 联系客户支持据/div> </div></a></li> <li class="dropdown-item"><a href="//www.gcpym.com/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-notes.svg')"></div> <div class="dropdown-text"> 产品文档据div class="dropdown-category"> 浏览产品指南据/div> </div></a></li> <li class="dropdown-item"><a href="//www.gcpym.com/release-notes/" class="has-icon">365必威 </a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/contact/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-envelope-email-checked-okay.svg')"></div> <div class="dropdown-text"> 联系我们据div class="dropdown-category"> 跟销售据/div> </div></a></li> </ul> <ul class="dropdown-menu"> <li class="dropdown-title">资源据/li> <li class="dropdown-item"><a href="https://www.rapid7.com/fundamentals/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-book-open.svg')"></div> <div class="dropdown-text"> 基础知识据div class="dropdown-category"> 基础安全知识据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/blog/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-signal-wifi.svg')"></div> <div class="dropdown-text"> 博客据div class="dropdown-category"> 最新的行业新闻和安全专业知识据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/resources/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-note-authenticate.svg')"></div> <div class="dropdown-text"> 资源库据div class="dropdown-category"> 电子书、白皮书、视频和简报据/div> </div></a></li> <li class="dropdown-item"><a href="https://extensions.rapid7.com/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-plug-outlet-collection.svg')"></div> <div class="dropdown-text"> 扩展库据div class="dropdown-category"> 插件，集成和开发者社区据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/partners/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-partners.svg')"></div> <div class="dropdown-text"> 合作伙伴据div class="dropdown-category"> Rapid7合作伙伴生态系统据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/about/events-webcasts/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-community-users.svg')"></div> <div class="dropdown-text"> 网络广播和事件据div class="dropdown-category"> 即将到来的机会与我们联系据/div> </div></a></li> <li class="dropdown-item"><a href="https://www.rapid7.com/db/" class="has-icon"> <div class="dropdown-icon" style="background-image:url('https://www.rapid7.com/globalassets/_icons/global-nav/icon-vulnerability.svg')"></div> <div class="dropdown-text"> 漏洞与利用数据库据div class="dropdown-category"> 搜索最新的安全研究必威体育西汉姆联官网据/div> </div></a></li> </ul> </div></li> <li class="main-nav__link "><a class="" href="https://www.rapid7.com/research/">必威体育西汉姆联官网</a></li> </ul> </div> <div class="main-nav__utility"> <ul> <li class="signin"><a href="https://insight.rapid7.com/saml/SSO"><img src="//www.gcpym.com/Areas/Docs/includes/img/r7-nav/icon-lock.svg">登录据/a></li> </ul> </div> </div> </nav> <section class="search-bar hide"> <div class="container flex flex-jc-c flex-ai-c"> <form action="/search" class="search-content flex flex-jc-c flex-ai-c"> <i class="r7-icon r7-icon-search-magnify"></i> <input type="search" class="search-input" name="q" placeholder="Search"> <input type="submit" class="search-submit button blue" value="搜索“>据input type="hidden" name="filters" value="productname\u InsightAppSec“>据a class="search-close"><i class="r7-icon r7-icon-delete-x"></i></a> </form> </div> </section> <div class="search-overlay overlay "></div> <nav class="sub-nav "> <div class="container flex flex-jc-sb"> <a class="logo circle-button" href="https://www.rapid7.com/"><img src="//www.gcpym.com/Areas/Docs/includes/img/r7-nav/Rapid7_logo-short.svg" alt="rapt7标志“></a> <div class="sub-nav__links flex"> <ul class="flex flex-ai-c"> <li class="sub-nav__title"><a href="//www.gcpym.com/">文件据/a></li> <li class="sub-nav__link dropdown "><a href="#" class="dropdown-trigger has-toggle">InsightAppSec据/a> <div class="dropdown-content two-col--sm"> <ul class="dropdown-menu"> <li class="dropdown-item"><a href="//www.gcpym.com/appspider/">appspider.据/a></li> <li class="dropdown-item"><a href="//www.gcpym.com/insight-agent/">必威体育app登录</a></li> <li class="dropdown-item"><a href="//www.gcpym.com/insightappsec/">2020刀塔必威赛事 </a></li> <li class="dropdown-item"><a href="//www.gcpym.com/insightidr/">Insightidr.据/a></li> </ul> <ul class="dropdown-menu"> <li class="dropdown-item"><a href="//www.gcpym.com/sensor/">洞察网络传感器据/a></li> <li class="dropdown-item"><a href="//www.gcpym.com/insightops/">Insigrops.据/a></li> <li class="dropdown-item"><a href="//www.gcpym.com/insightvm/">InsightVM据/a></li> <li class="dropdown-item"><a href="//www.gcpym.com/metasploit/">metasploit.据/a></li> <li class="dropdown-item"><a href="//www.gcpym.com/nexpose/">nexpose据/a></li> <li class="dropdown-item"><a href="//www.gcpym.com/tcell/">tCell据/a></li> <li class="dropdown-item"><a href="//www.gcpym.com/services/">Rapid7服务据/a></li> </ul> <div class="dropdown-view-all"> <a href="//www.gcpym.com/release-notes/">发行说明据/a> </div> </div></li> </ul> </div> <div class="sub-nav__utility"> <a class="search"><i class="r7-icon r7-icon-search-magnify"></i></a> <a class="to-top circle-button"><i class="r7-icon r7-icon-arrow-chevron-up-solid"></i></a> </div> </div> </nav> </header> </div> </div> <div class="sidebar-container" id="product-doc"> <div id="react_0HMBM66V3BCCI"> <div class="container flex"> <div class="sidebar-content"> <div class="subnav"> <div class="subnav_group"> <h3>开始据span class="subnav_list-toggle plus"></span></h3> <div style="display:none"> <ul class="subnav_list"> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/getting-started" class=" "><span class="subnav_list-text">欢迎来到Insightappsec.据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/quick-start" class=" "><span class="subnav_list-text">快速入门指南据/span><span class="subnav_list-toggle plus"></span></a> <div class="subnav_list-sub"> <ul> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/objective-1-set-the-stage" class=" "><span class="subnav_list-text">设置舞台:添加一个应用程序据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/objective-2-gain-visibility" class=" "><span class="subnav_list-text">获取可见性:配置扫描据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/objective-identify-risks" class=" "><span class="subnav_list-text">识别风险：扫描您的应用程序据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/objective-3-extract-insights" class=" "><span class="subnav_list-text">优先化修复：与漏洞一起工作据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/objective-4-share-results" class=" "><span class="subnav_list-text">共享结果:生成报告据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/objective-6-extend-coverage" class=" "><span class="subnav_list-text">指南修复：监控和测试据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/objective-7-act-local" class=" "><span class="subnav_list-text">ACT本地：本地扫描据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/free-trial-quick-start" class=" "><span class="subnav_list-text">免费试用快速入门据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> </ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/concepts" class=" "><span class="subnav_list-text">概念据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> </ul> </div> </div> <div class="subnav_group"> <h3>设置和部署据span class="subnav_list-toggle plus"></span></h3> <div style="display:none"> <ul class="subnav_list"> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/allowlist-cloud-engine-ips" class=" "><span class="subnav_list-text">Allowlist云引擎IPs据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/allowlist-manage-targets" class=" "><span class="subnav_list-text">允许列出并管理目标据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/setting-up-an-on-premise-scan-engine" class=" "><span class="subnav_list-text">设置本地扫描引擎据/span><span class="subnav_list-toggle plus"></span></a> <div class="subnav_list-sub"> <ul> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/upgrade-an-on-premises-scan-engine" class=" "><span class="subnav_list-text">升级内部部署扫描引擎据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> </ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/uninstall-an-on-premise-scan-engine" class=" "><span class="subnav_list-text">卸载本地扫描引擎据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/regenerate-engine-api-key" class=" "><span class="subnav_list-text">重新生成引擎API密钥据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/appsec-chrome-extension" class=" "><span class="subnav_list-text">安装适用于Chrome的Rapid7 AppSec插件据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/configure-email-notifications" class=" "><span class="subnav_list-text">配置邮件通知据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> </ul> </div> </div> <div class="subnav_group"> <h3>识别风险据span class="subnav_list-toggle minus"></span></h3> <div> <ul class="subnav_list"> <li class="subnav_list-item subnav_list-item--open"><a href="//www.gcpym.com/insightappsec/scan-configuration" class=" "><span class="subnav_list-text">配置扫描据/span><span class="subnav_list-toggle minus"></span></a> <div class="subnav_list-sub"> <ul> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/scan-scope" class=" "><span class="subnav_list-text">扫描范围据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/how-to-configure-scan-scope" class=" "><span class="subnav_list-text">如何使用扫描范围据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item subnav_list-item--open"><a href="//www.gcpym.com/insightappsec/authentication" class="active "><span class="subnav_list-text">认证据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/attack-templates" class=" "><span class="subnav_list-text">攻击模板据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/attack-modules" class=" "><span class="subnav_list-text">攻击模块据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/custom-options" class=" "><span class="subnav_list-text">自定义选项据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/advanced-options" class=" "><span class="subnav_list-text">高级选项据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> </ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/scan-your-app" class=" "><span class="subnav_list-text">扫描你的应用程序据/span><span class="subnav_list-toggle plus"></span></a> <div class="subnav_list-sub"> <ul> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/schedules-and-blackouts" class=" "><span class="subnav_list-text">安排扫描或断电据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/common-crawling-issues" class=" "><span class="subnav_list-text">常见爬行问题据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> </ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/work-with-vulnerabilities" class=" "><span class="subnav_list-text">一起工作的漏洞据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/add-an-app" class=" "><span class="subnav_list-text">管理应用程序据/span><span class="subnav_list-toggle plus"></span></a> <div class="subnav_list-sub"> <ul> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/manage_app_files" class=" "><span class="subnav_list-text">管理应用程序文件据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/tag-apps" class=" "><span class="subnav_list-text">应用标记据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/manage-user-access" class=" "><span class="subnav_list-text">管理用户访问据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> </ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/how-do-i" class=" "><span class="subnav_list-text">常见问题解答据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> </ul> </div> </div> <div class="subnav_group"> <h3>分享结果据span class="subnav_list-toggle plus"></span></h3> <div style="display:none"> <ul class="subnav_list"> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/show-progress-with-reports" class=" "><span class="subnav_list-text">通过报告显示进度据/span><span class="subnav_list-toggle plus"></span></a> <div class="subnav_list-sub"> <ul> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/generate-reports" class=" "><span class="subnav_list-text">生成报告据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/reports-by-type" class=" "><span class="subnav_list-text">报告类型据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> </ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/monitor-appsec-data-with-dashboards" class=" "><span class="subnav_list-text">用仪表板监控AppSec数据据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/export-your-data" class=" "><span class="subnav_list-text">导出数据据/span><span class="subnav_list-toggle plus"></span></a> <div class="subnav_list-sub"> <ul> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/export-csv" class=" "><span class="subnav_list-text">导出为CSV据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/export-crawl-map" class=" "><span class="subnav_list-text">出口爬网地图据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/ticketing-integration" class=" "><span class="subnav_list-text">票务集成据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> </ul> </div></li> </ul> </div> </div> <div class="subnav_group"> <h3>集成据span class="subnav_list-toggle plus"></span></h3> <div style="display:none"> <ul class="subnav_list"> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/jenkins-integration" class=" "><span class="subnav_list-text">Jenkins Integation.据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/azure-devops-integration" class=" "><span class="subnav_list-text">Azure Devops集成据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/bamboo-integration" class=" "><span class="subnav_list-text">竹集成据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> </ul> </div> </div> <div class="subnav_group"> <h3>API指南据span class="subnav_list-toggle plus"></span></h3> <div style="display:none"> <ul class="subnav_list"> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/API_guide" class=" "><span class="subnav_list-text">Insightappsec API.据/span><span class="subnav_list-toggle plus"></span></a> <div class="subnav_list-sub"> <ul> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/learn-about-apis" class=" "><span class="subnav_list-text">了解API据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/api-use-cases" class=" "><span class="subnav_list-text">API用例据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> </ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/api-get-started" class=" "><span class="subnav_list-text">开始使用API据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/api-setup-deploy" class=" "><span class="subnav_list-text">设置和部署据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/api-identify-risk" class=" "><span class="subnav_list-text">识别风险据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> </ul> </div> </div> <div class="subnav_group"> <h3>发行说明据span class="subnav_list-toggle plus"></span></h3> <div style="display:none"> <ul class="subnav_list"> <li class="subnav_list-item"><a href="//www.gcpym.com/release-notes/insightappsec/" target="_blank" class=" external"><span class="subnav_list-text">Insightappsec发行说明据i class="r7-icon r7-icon-open-new-tab"></i></span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> </ul> </div> </div> <div class="subnav_group"> <h3>支持据span class="subnav_list-toggle plus"></span></h3> <div style="display:none"> <ul class="subnav_list"> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/contact-the-rapid7-support-team" class=" "><span class="subnav_list-text">联系Rapid7支持团队据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> <li class="subnav_list-item"><a href="//www.gcpym.com/insightappsec/share-an-idea" class=" "><span class="subnav_list-text">与Rapid7分享你的想法据/span></a> <div class="subnav_list-sub"> <ul></ul> </div></li> </ul> </div> </div> </div> </div> <div class="main-content"> <div class="inner-content"> <div class="html-block"> <h1 id="configure-scan-authentication">配置扫描身份验证据span title="Copy link to clipboard"></span></h1> <p>Web应用程序通常只有一个用于注册用户的部分。只能通过登录应用程序来评估Web应用程序的这一部分。登录的过程称为“身份验证”。Insightappsec支持许多方法来验证您的应用程序。可以在“扫描配置”向导的“身份验证”选项卡上配置这些。</p> <p>Insightappsec支持以下身份验证类型：据/p> <ul> <li><strong>场地据/strong> <ul> <li><a href="#automated-login">自动登录据/a></li> <li><a href="#macro-authentication">宏据/a></li> <li><a href="#traffic">交通据/a></li> <li><a href="#multi-factor">多因素据/a></li> <li><a href="#selenium">硒据/a></li> <li><a href="#session-hijacking">会话劫持据/a></li> </ul></li> <li><strong>浏览器据/strong> <ul> <li><a href="#http-authentication">http.据/a></li> <li><a href="#hmac">HMAC.据/a></li> <li><a href="#ssl-certificates">SSL据/a></li> </ul></li> <li><strong>服务器据/strong> <ul> <li><a href="#oauth">非统组织据/a></li> <li><a href="#adal">阿达尔据/a></li> </ul></li> <li><strong>注销设置据/strong> <ul> <li><a href="#advanced">登录和注销正则表达式据/a></li> </ul></li> </ul> <h2 id="automated-login">自动登录据span title="Copy link to clipboard"></span></h2> <p>现代web应用程序的界面比简单的HTML网站更复杂。自动登录允许您自动验证到现代应用程序在扫描而不依赖宏。在自动登录认证扫描期间，InsightAppSec分析和识别登录页面，输入凭据，并自动登录到应用程序。</p> <h4 id="configure-automated-login">配置自动登录据span title="Copy link to clipboard"></span></h4> <ol> <li>在据strong>所有应用程序据/strong>Page，选择您的应用程序。据/li> <li>在据strong>扫描配置据/strong>选项卡，打开扫描配置。据/li> <li>在据strong>认证>站点认证据/strong>页面，选择据strong>自动登录据/strong>．据/li> <li>在相应字段中输入用户名和密码。据/li> <li>(可选)据a href="#test-your-login-credentials">测试登录凭据据/a>．据/li> <li>保存扫描配置。据ul> <li>点击据strong>保存据/strong>保存并关闭。据/li> <li>点击据strong>保存和扫描据/strong>保存并运行扫描。据/li> </ul></li> </ol> <h4 id="test-your-login-credentials">测试您的登录凭证据span title="Copy link to clipboard"></span></h4> <p>在添加或更新扫描配置时测试登录凭据，以捕获不正确的凭据，并在扫描期间遇到问题之前解决这些凭据。据/p> <div class="block-callout warning"> <h3>验证凭据所需的AppSec Chrome插件据span title="Copy link to clipboard"></span></h3> <p>你需要据a href="//www.gcpym.com/insightappsec/appsec-chrome-extension">AppSec Chrome扩展据/a>以核实你的证件。据/p> </div> <ol> <li>在扫描配置中，在据strong>认证据/strong>选项卡,去据strong>自动登录据/strong>．据/li> <li>在据strong>验证证书据/strong>节中，输入登录URL、用户名和密码。据/li> <li>点击据strong>验证证书据/strong>．出现一个窗口，显示实时登录尝试。</li> <li>在成功验证凭据之后，保存扫描配置。据ul> <li>点击据strong>保存据/strong>保存并关闭。据/li> <li>点击据strong>保存和扫描据/strong>保存并运行扫描。据br>保存扫描配置时，凭据已加密。要验证保存的扫描配置上的凭据，请重新输入用户名和密码。</li> </ul></li> </ol> <details> <summary>宏观的身份验证据/summary> <p>InsightappSec有时可能无法到达应用程序的登录页面，或者才能在您的网站上执行某种特定的操作序列后，登录表单可能会获得。例如，登录表单可能出现在弹出窗口中，当从“管理”窗口按下“登录”按钮时，通过JavaScript动态生成。您可以通过录制宏来启用InsightAppsec来执行此步骤序列。宏是一系列操作，例如单击按钮，或在记录在一个网页中的文本条目据code class="prism-code language-text"><span class="token-line"><span class="token plain">.rec据/span></span></code>文件。在扫描过程中，Insightappsec可以重播此文件中的操作以登录Web应用程序。</p> <div class="block-callout warning"> <h3>攻击重播所需的AppSec Chrome插件据span title="Copy link to clipboard"></span></h3> <p>你需要据a href="//www.gcpym.com/insightappsec/appsec-chrome-extension">AppSec Chrome扩展据/a>为了记录宏验证到您的应用程序。据/p> </div> <h4 id="configure-macro-authentication">配置宏身份验证据span title="Copy link to clipboard"></span></h4> <ol> <li>打开据strong>认证>站点认证据/strong>页面和选择据strong>宏观的身份验证据/strong>．据/li> <li>点击据strong>记录新宏据/strong>按钮并输入应用程序的登录URL。一旦完成，请点击据strong>开始记录据/strong>按钮。据a style="cursor:pointer" title=""><img src="//www.gcpym.com/api/docs/file/product-documentation__master/insightappsec/images/auth-macro.png" alt="身份验证宏“></a></li> <li>将出现一个确认对话框，通知录制序列已开始。宏窗口将在您提供的URL上打开。只需正常登录。已成功登录后，关闭宏窗口并单击据strong>停止录音据/strong>按钮。据/li> <li>将显示一条消息，确认录制成功。为宏命名，然后单击据strong>保存宏据/strong>按钮。您现在应该可以看到录制的宏。[/block]据/li> <li>保存并运行您的配置。它现在将尝试使用录制的宏进行身份验证。如果成功，则会在扫描的事件日志中显示以下内容：据a style="cursor:pointer" title=""><img src="//www.gcpym.com/api/docs/file/product-documentation__master/insightappsec/images/auth-macro-success.png" alt="成功的身份验证宏“></a></li> </ol> <p>默认情况下，AppSec插件记录的宏设置如下:据/p> <pre class="prism-code language-text"> <div class="code-header"> <div class="code-copy" title="Copy to clipboard"> <i class="r7-icon r7-icon-copy-clipboard"></i> </div> </div><code class="prism-code language-text"> <div class="token-line"> <div class="code-line-no"> 1据/div> <span class="code-line-content"><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 2据/div> <span class="code-line-content"><span class="token plain">格式：“xml”据/span></span> </div> <div class="token-line"> <div class="code-line-no"> 3.据/div> <span class="code-line-content"><span class="token plain">最小持续时间：3000，据/span></span> </div> <div class="token-line"> <div class="code-line-no"> 4.据/div> <span class="code-line-content"><span class="token plain">元素路径：“完整路径”据/span></span> </div> <div class="token-line"> <div class="code-line-no"> 5.据/div> <span class="code-line-content"><span class="token plain">event_type：“JavaScript”据/span></span> </div></code></pre> </details> <details> <summary>交通据/summary> <p>您可能会遇到使用InsightAppSec爬虫不支持的技术构建的web应用程序。您可以使用web代理工具（如中的流量记录器）对此类应用程序进行身份验证据a href="https://blog.rapid7.com/2018/06/14/new-insightappsec-releases-compliance-reports-and-the-appsec-toolkit/">Rapid7 AppSec工具包据/a>．使用代理工具，您可以在流量文件中记录前端应用程序和后端服务器之间的交互(例如HTTP GET和POST请求)。InsightAppSec可以重播这些交互以在应用程序中进行身份验证。</p> <h4 id="authenticate-with-a-traffic-file">使用流量文件进行身份验证据span title="Copy link to clipboard"></span></h4> <ol> <li>完成登录应用程序的步骤，并在计算机上的流量文件中记录交互。流量文件可以采用以下格式：据ul> <li>appsec toolkit流量文件（* .trec）据/li> <li>Burp文件（* .xml）据/li> <li>Paros文件（* .txt）据/li> <li>WebScarab文件(conversationlog)据/li> <li>文件(*.har)据/li> <li>Fiddler文件（* .saz）据/li> </ul></li> <li>打开据strong>认证>站点认证据/strong>页面和选择据strong>交通据/strong>．据/li> <li>点击据strong>选择文件据/strong>按钮。这将打开“选择文件”弹出窗口。</li> <li>点击据strong>上载文件据/strong>按钮和上传交通文件从你的电脑。据/li> <li>从弹出窗口中的“所有文件”选项卡中选择新上传的文件或现有流量文件。据/li> <li>点击据strong>使用1个选定文件据/strong>按钮。据/li> </ol> </details> <h2 id="multi-factor">多因素据span title="Copy link to clipboard"></span></h2> <p>许多现代web应用程序使用安全措施，如双因素身份验证和CAPTCHA，这需要手动干预登录应用程序。例如，您的应用程序可能需要通过短信发送一次性密码。多因素身份验证将暂停活动扫描，并允许您以交互方式登录到目标应用程序。验证完成后，可以恢复扫描。扫描引擎将继续抓取并攻击您的应用程序。</p> <p>为了启用多因素身份验证，您将需要：据/p> <ul> <li>Chrome浏览器据/li> <li>最新版本的AppSec Chrome扩展据/li> <li>如果您使用的本地扫描引擎，则发动机版本号7.2.049或更高版本据/li> </ul> <h4 id="enabling-multi-factor-authentication-for-a-scan">启用扫描的多因素身份验证据span title="Copy link to clipboard"></span></h4> <p>要为扫描启用多因素身份验证，请转到据strong>身份验证>身份验证类型据/strong>．点击据strong>身份验证类型据/strong>下拉选择据strong>多因素据/strong>．据/p> <p>开始扫描后：据/p> <ol> <li>监控扫描表。当您的扫描已准备好进行身份验证时，“状态”列将显示“等待身份验证”的消息。</li> <li>单击扫描名称，打开扫描窗口。您将在屏幕的右上方看到“Authenticate Scan”按钮。</li> <li>点击据strong>验证扫描据/strong>按钮如果您尚未安装AppSec Chrome扩展，您将看到一条消息，提示您安装它。如果您已经安装了扩展，您将看到“Multi-factor Authentication”（多因素身份验证）屏幕。据/li> <li>输入应用程序的URL，单击据strong>开始据/strong>．将会出现一个带有文件名称的弹出消息，其中多因素认证网络流量将被记录在Insight Platform上。dota2必威联赛点击据strong>好吧据/strong>接着说。将弹出Chrome浏览器窗口并为您的URL打开网页。</li> <li>登录应用程序。登录成功后，关闭Chrome窗口，返回“Multi-factor Authentication”界面。</li> </ol> <div class="block-callout warning"> <h3>笔记据span title="Copy link to clipboard"></span></h3> <p>在此步骤中，您应该只执行登录到应用程序所需的步骤。InsightAppSec扫描引擎将重播这些步骤并匹配来自据strong>高级>登录Regex据/strong>字段到在浏览器中打开的网页。在确认身份验证成功后，它将继续扫描。</p> </div> <ol start="6"> <li>点击据strong>停止据/strong>。多因素身份验证屏幕将关闭，您将返回扫描窗口。据/li> <li>监视“事件日志”以确保身份验证成功。Chrome扩展记录了身份验证会话的Web流量，并将其转换为HTTP归档（HAR）文件。扫描引擎重放内存中的此流量以登录您的应用程序。如果登录是成功的，您将看到消息“会话”身份验证，使用多因素文件：“登录”在事件日志中。您还可以看到扫描页面上爬网链接下的状态“登录”状态。</li> </ol> <p>如果登录不成功，应确保据a href="//www.gcpym.com/insightappsec/authentication">先进的据/a>“屏幕与验证后显示的网页中的文本相匹配。如果登录状态指示器隐藏在菜单项下，请展开它，以便InsightAppSec可以检查它并检查登录状态。据/p> <p>例如，如果要使用“Logout”链接的存在作为用户已登录的指示灯，则将注销链接作为身份验证步骤的一部分隐藏的下拉列表展开。据/p> <details> <summary>硒据/summary> <p>Selenium是一种用于Web应用程序的自动化测试的框架。用户可以记录使用Selenium以表单和单击按钮输入数据的操作，并按需重播它们以确保Web应用程序的行为。</p> <p>InsightAppSec支持使用Selenium文件进行身份验证，因此您可以在Selenium中记录登录到应用程序所需的操作据code class="prism-code language-text"><span class="token-line"><span class="token plain">. html据/span></span></code>文件扫描期间，InsightAppSec可以重播此文件中的操作以登录到web应用程序。以下是的Selenium身份验证文件据a href="http://webscantest.com">http://webscantest.com据/a>．据/p> <div data-title=""> <pre class="prism-code language-tsx"> <div class="code-header"> XML.据div class="code-copy" title="Copy to clipboard"> <i class="r7-icon r7-icon-copy-clipboard"></i> </div> </div><code class="prism-code language-tsx"> <div class="token-line"> <div class="code-line-no"> 1据/div> <span class="code-line-content"><span class="token prolog"><？xml version=“1.0”encoding=“UTF-8”>据/span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 2据/div> <span class="code-line-content"><span class="token plain"></span><span class="token operator">据</span><span class="token operator">！！据/span><span class="token constant">DOCTYPE据/span><span class="token plain">html据/span><span class="token constant">公开的据/span><span class="token plain"></span><span class="token string">“ - // w3c // dtd xhtml 1.0 strict // en”据/span><span class="token plain"></span><span class="token string">“http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd”据/span><span class="token operator">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 3.据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">html据/span><span class="token tag"></span><span class="token tag attr-name">xmlns据/span><span class="token tag attr-value punctuation">=</span><span class="token tag attr-value punctuation">“据/span><span class="token tag attr-value">http://www.w3.org/1999/xhtml.据/span><span class="token tag attr-value punctuation">“据/span><span class="token tag"></span><span class="token tag attr-name namespace">xml:据/span><span class="token tag attr-name">朗据/span><span class="token tag attr-value punctuation">=</span><span class="token tag attr-value punctuation">“据/span><span class="token tag attr-value">EN.据/span><span class="token tag attr-value punctuation">“据/span><span class="token tag"></span><span class="token tag attr-name">朗据/span><span class="token tag attr-value punctuation">=</span><span class="token tag attr-value punctuation">“据/span><span class="token tag attr-value">EN.据/span><span class="token tag attr-value punctuation">“据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 4.据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">头据/span><span class="token tag"></span><span class="token tag attr-name">轮廓据/span><span class="token tag attr-value punctuation">=</span><span class="token tag attr-value punctuation">“据/span><span class="token tag attr-value">http://selenium-ide.openqa.org/profiles/test-case据/span><span class="token tag attr-value punctuation">“据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 5.据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">元据/span><span class="token tag"></span><span class="token tag attr-name">HTTP-Equiv.据/span><span class="token tag attr-value punctuation">=</span><span class="token tag attr-value punctuation">“据/span><span class="token tag attr-value">内容类型据/span><span class="token tag attr-value punctuation">“据/span><span class="token tag"></span><span class="token tag attr-name">内容据/span><span class="token tag attr-value punctuation">=</span><span class="token tag attr-value punctuation">“据/span><span class="token tag attr-value">text/html；字符集=UTF-8据/span><span class="token tag attr-value punctuation">“据/span><span class="token tag"></span><span class="token tag punctuation">/>据/span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 6.据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">关联据/span><span class="token tag"></span><span class="token tag attr-name">rel.据/span><span class="token tag attr-value punctuation">=</span><span class="token tag attr-value punctuation">“据/span><span class="token tag attr-value">selenium.base据/span><span class="token tag attr-value punctuation">“据/span><span class="token tag"></span><span class="token tag attr-name">href据/span><span class="token tag attr-value punctuation">=</span><span class="token tag attr-value punctuation">“据/span><span class="token tag attr-value">http://webscantest.com/据/span><span class="token tag attr-value punctuation">“据/span><span class="token tag"></span><span class="token tag punctuation">/>据/span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 7.据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">标题据/span><span class="token tag punctuation">></span><span class="token plain">硒据/span><span class="token tag punctuation"></据/span><span class="token tag">标题据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 8.据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation"></据/span><span class="token tag">头据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 9.据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">身体据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 10据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">表格据/span><span class="token tag"></span><span class="token tag attr-name">单元格边距据/span><span class="token tag attr-value punctuation">=</span><span class="token tag attr-value punctuation">“据/span><span class="token tag attr-value">1据/span><span class="token tag attr-value punctuation">“据/span><span class="token tag"></span><span class="token tag attr-name">单元格间距据/span><span class="token tag attr-value punctuation">=</span><span class="token tag attr-value punctuation">“据/span><span class="token tag attr-value">1据/span><span class="token tag attr-value punctuation">“据/span><span class="token tag"></span><span class="token tag attr-name">边境据/span><span class="token tag attr-value punctuation">=</span><span class="token tag attr-value punctuation">“据/span><span class="token tag attr-value">1据/span><span class="token tag attr-value punctuation">“据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 11据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">thead据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 12据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">tr据/span><span class="token tag punctuation">></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag"></span><span class="token tag attr-name">行宽据/span><span class="token tag attr-value punctuation">=</span><span class="token tag attr-value punctuation">“据/span><span class="token tag attr-value">1据/span><span class="token tag attr-value punctuation">“据/span><span class="token tag"></span><span class="token tag attr-name">Colspan.据/span><span class="token tag attr-value punctuation">=</span><span class="token tag attr-value punctuation">“据/span><span class="token tag attr-value">3.据/span><span class="token tag attr-value punctuation">“据/span><span class="token tag punctuation">></span><span class="token plain">硒据/span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token tag punctuation"></据/span><span class="token tag">tr据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 13据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation"></据/span><span class="token tag">thead据/span><span class="token tag punctuation">></span><span class="token tag punctuation">据</span><span class="token tag">tbody据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 14据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">tr据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 15据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain">开放据/span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 16据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token operator">/据/span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 17据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 18据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation"></据/span><span class="token tag">tr据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 19据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">tr据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 20.据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain">clickandwait.据/span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 21据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain">关联据/span><span class="token operator">=</span><span class="token maybe-class-name">登录据/span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 22据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 23据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation"></据/span><span class="token tag">tr据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 24据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">tr据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 25据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token keyword">类型据/span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 26据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain">名字据/span><span class="token operator">=</span><span class="token plain">登录据/span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 27据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain">管理据/span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 28据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation"></据/span><span class="token tag">tr据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 29据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">tr据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 30.据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token keyword">类型据/span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 31据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain">名字据/span><span class="token operator">=</span><span class="token plain">passwd据/span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 32据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain">管理据/span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 33据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation"></据/span><span class="token tag">tr据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 34据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">tr据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 35据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain">clickandwait.据/span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 36据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain">名字据/span><span class="token operator">=</span><span class="token plain">submit_login据/span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 37据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation">据</span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token tag punctuation"></据/span><span class="token tag">道明据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 38据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation"></据/span><span class="token tag">tr据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 39据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation"></据/span><span class="token tag">tbody据/span><span class="token tag punctuation">></span><span class="token tag punctuation"></据/span><span class="token tag">表格据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 40据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation"></据/span><span class="token tag">身体据/span><span class="token tag punctuation">></span><span class="token plain"></span></span> </div> <div class="token-line"> <div class="code-line-no"> 41据/div> <span class="code-line-content"><span class="token plain"></span><span class="token tag punctuation"></据/span><span class="token tag">html据/span><span class="token tag punctuation">></span></span> </div></code></pre> </div> <h4 id="authenticate-with-a-selenium-file">使用selenium文件进行身份验证据span title="Copy link to clipboard"></span></h4> <ol> <li>控件的Selenium文件中，完成登录到应用程序的步骤并记录交互据code class="prism-code language-text"><span class="token-line"><span class="token plain">. html据/span></span></code>格式。据/li> <li>在据strong>认证>站点认证据/strong>页面，选择据strong>硒据/strong>．据/li> <li>点击据strong>选择文件据/strong>按钮。这将打开“选择文件”弹出窗口。</li> <li>点击据strong>上载文件据/strong>按钮并从计算机上传Selenium文件。据/li> <li>从弹出窗口中的“所有文件”选项卡中选择新上传的文件或现有的Selenium文件。据/li> <li>点击据strong>使用1个选定文件据/strong>按钮。据/li> </ol> <h2 id="session-hijacking">会话劫持据span title="Copy link to clipboard"></span></h2> <p>如果您的Web应用程序使用会话cookie来维护登录状态，可以捕获此cookie并使用会话劫持方法进行身份验证。将会话cookie复制并粘贴到可用框中。</p> <p><a style="cursor:pointer" title=""><img src="//www.gcpym.com/api/docs/file/product-documentation__master/insightappsec/images/auth-session-hijacking.png" alt="会话劫持“></a></p> </details> <h2 id="configure-browser-authentication">配置浏览器身份验证据span title="Copy link to clipboard"></span></h2> <p>您可以为每种身份验证类型启用身份验证。在扫描配置中的“身份验证”>“浏览器身份验证”页面上，使用切换启用浏览器身份验证，并配置身份验证方法。据/p> <details> <summary>HTTP身份验证据/summary> <p>HTTP协议支持使用用户名和密码进行身份验证。您可以使用此参考文章了解有关HTTP身份验证的更多信息：据a href="https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/understanding-http-authentication">https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/unterstand-http-authentication.据/a></p> <p>InsightAppSec支持基本协议、NTLM协议和Kerberos协议进行HTTP认证。据/p> <h4 id="configure-the-authentication-process">配置身份验证过程据span title="Copy link to clipboard"></span></h4> <ol> <li>打开据strong>认证> HTTP认证据/strong>屏幕。据/li> <li>点击据strong>启用http验证据/strong>切换以启用HTTP身份验证。据/li> <li>在相应字段中输入用户名和密码。据/li> </ol> </details> <details> <summary>HMAC.据/summary> <p>HMAC是使用加密散列函数和秘密密钥来进行身份验证的MAC（消息身份验证码）。要了解更多关于HMAC的信息，请参阅据a href="https://en.wikipedia.org/wiki/HMAC">https://en.wikipedia.org/wiki/HMAC据/a>．据/p> <h4 id="configure-hmac-authentication">配置HMAC身份验证据span title="Copy link to clipboard"></span></h4> <ol> <li>去据strong>验证> HMAC据/strong>页。据/li> <li>使用切换按钮可以据strong>启用HMAC据/strong>．据/li> <li>输入如下信息:据ul> <li>用户名-哈希算法的用户名。据/li> <li>秘钥-用于计算HMAC的唯一代码。发送方和接收方都知道它。</li> <li>哈希算法-选择哈希算法类型。据ul> <li>Md5据/li> <li>SHA1据/li> <li>Sha256据/li> </ul></li> </ul></li> </ol> <ul> <li>头文件生成DLL文件名-用户创建的DLL文件(据a href="https://support.microsoft.com/en-us/help/815065/what-is-a-dll">https://support.microsoft.com/en-us/help/815065/what-is-a-dll据/a>），包含加密散列函数。仅在使用内部内部引擎时才需要这一点。如果您没有提供文件，系统将使用引擎提供的DLL。</li> </ul> </details> <details> <summary>SSL证书据/summary> <p>您可能需要在客户端验证您的应用程序，以便您可以扫描SSL后面的页面。此身份验证方法可与云和内部部署扫描引擎一起使用。</p> <div class="block-callout warning"> <h3>PFX证书格式据span title="Copy link to clipboard"></span></h3> <p>SSL证书必须为。pfx文件。据/p> </div> <h4 id="configure-ssl-authentication">配置SSL身份验证据span title="Copy link to clipboard"></span></h4> <ol> <li>去据strong>> SSL身份验证据/strong>．据/li> <li>在据strong>类型据/strong>下拉，选择据strong>证书。据/strong></li> <li>选择您的SSL.pfx文件。据/li> <li>3 .可选:如果需要输入密码，请在提供的框中输入。据/li> </ol> </details> <h2 id="configure-server-authentication">配置服务器身份验证据span title="Copy link to clipboard"></span></h2> <p>在“扫描配置”中，在“身份验证”>“服务器身份验证”页面上，使用Toggle启用服务器身份验证，并配置身份验证方法。据/p> <details> <summary>非统组织据/summary> <p>OAuth（据a href="https://oauth.net/">https://oauth.net/据/a>）是一种授权方法，用于授予对客户端的细粒度访问权限。Insightappsec支持OAuth 2.0，这是授权的行业标准协议。OAuth 2.0专注于客户端开发人员简单性，同时为Web应用程序，桌面应用程序，移动电话和客厅设备提供特定的授权流程。如果您的应用程序授予InsightappSec访问某些功能，则可以输入所需的详细信息据strong>身份验证> OAuth.据/strong>屏幕。启动扫描时，Insightappsec可以向您的应用程序提供这些详细信息并接收访问令牌。</p> <h4 id="set-up-oauth-authentication">设置OAuth身份验证据span title="Copy link to clipboard"></span></h4> <p>如果您想扫描使用OAuth的应用程序，您需要知道应用程序使用的授权类型。您通常可以从应用程序开发人员那里获得这些信息。如果您检查来自连接的流量，通常还可以在URL中看到授予类型。</p> <p><a style="cursor:pointer" title=""><img src="//www.gcpym.com/api/docs/file/product-documentation__master/insightappsec/images/auth-oauth.png" alt="非统组织“></a></p> <h3 id="oauth-and-automated-login">OAuth和自动登录据span title="Copy link to clipboard"></span></h3> <p>这据strong>身份验证> OAuth.据/strong>屏幕有许多选项来配置应用程序的OAuth属性。您需要点击据strong>支持OAUTH据/strong>切换以启用OAuth身份验证，然后根据您的授予类型提供所需的值。据/p> <ul> <li><strong>资源所有者URL据/strong>- 能够授予对受保护资源的访问的实体。可选，在大多数情况下，应等于资源服务器URL</li> <li><strong>资源服务器URL.据/strong>- API服务器的标识符。在应用程序获得访问令牌后，资源服务器处理经过身份验证的请求</li> <li><strong>身份验证服务器URL据/strong>- 从身份提供程序获取的身份验证服务器URL（参考：据a href="https://en.wikipedia.org/wiki/Identity_provider">https://en.wikipedia.org/wiki/Identity_provider据/a>）据/li> <li><strong>重定向的URI据/strong>- 授权服务器将用户重新定向返回的URL，在URL中使用授权代码或访问令牌。如果为空，将使用资源服务器URL</li> <li><strong>客户范围据/strong>-一个或多个空格分隔的字符串，表示应用程序正在请求哪些权限。您使用的特定OAuth API将定义它所支持的作用域</li> <li><strong>客户ID据/strong>-从您的身份证明提供者获得的申请的公共识别码据/li> <li><strong>客户秘密据/strong>-应用程序的客户端秘密，从您的身份提供者获得。这确保仅从应用程序发出获取访问令牌的请求</li> <li><strong>客户状态据/strong>—应用程序生成一个随机字符串并将其包含在请求中。然后，它应该检查用户授权应用程序后返回的值是否相同。这是用来防止CSRF攻击的</li> <li><strong>ExtensionGrant据/strong>- 此刻可以忽略据/li> <li><strong>用户名据/strong>—使用“资源所有者密码凭据”或“客户端凭据”授予类型时，最终用户的用户名据/li> <li><strong>密码据/strong>—使用“资源所有者密码凭证”或“客户端凭证”授予类型时，最终用户的密码据/li> <li><strong>用户名表单据/strong>-应用程序上额外表单验证流的用户名据/li> <li><strong>密码表据/strong>-应用程序上额外表单验证流程的密码据/li> <li><strong>永远不要做基本的授权据/strong>防止InsightAppSec在使用“资源所有者密码凭据”或“客户端凭据”的情况下发送HTTP基本认证头(base64编码的用户名和密码值)据/li> </ul> <h3 id="oauth-grant-types">OAuth授予类型据span title="Copy link to clipboard"></span></h3> <p>根据您的用例，您将需要使用不同的OAuth流。“授予类型”属性决定了应用程序正在使用的OAuth流。你可以在此了解更多奖助金类型:据a href="https://oauth.net/2/grant-types/">https://oauth.net/2/grant-types/据/a>．据/p> <p>下表可帮助您为申请选择合适的补助金类型。据/p> <p><a style="cursor:pointer" title=""><img src="//www.gcpym.com/api/docs/file/product-documentation__master/insightappsec/images/auth-grant-types.png" alt="格兰特类型“></a></p> <p>以下部分描述了您需要根据您的授予类型提供insightappsec的OAuth属性。据/p> <details> <summary>授权代码据/summary> <p>授权码授权类型用于web和移动应用程序。它与大多数其他授权类型的不同之处是，首先需要应用程序启动一个浏览器来启动流程。在较高的级别上，流程有以下步骤:</p> <ul> <li>该应用程序打开浏览器以将用户发送到OAuth Server据/li> <li>用户看到授权提示符并批准应用程序的请求据/li> <li>用户被重定向回具有查询字符串中的授权代码的应用程序据/li> <li>应用程序用授权代码交换访问令牌据/li> </ul> <p>授权代码流最好由源代码未公开的服务器端应用程序使用。应用程序应该是服务器端，因为交换令牌授权代码的请求需要一个客户端机密，而这个机密必须存储在您的客户端中。然而，服务器端应用程序需要终端用户，因为它依赖于与终端用户的web浏览器的交互，后者将重定向用户，然后接收授权代码。看据a href="https://developer.okta.com/authentication-guide/auth-overview/">https://developer.okta.com/authentication-guide/auth-overview/#authorization-code-flow据/a>和据a href="https://developer.okta.com/authentication-guide/implementing-authentication/auth-code">https://developer.okta.com/authentication-guide/implementing-authentication/auth-code据/a>了解更多信息。据/p> <h3 id="mandatory-properties">强制性的属性据span title="Copy link to clipboard"></span></h3> <ul> <li>资源服务器URL.据/li> <li>客户ID据/li> </ul> </details> <details> <summary>隐含据/summary> <p>隐式授权类型是公共客户端可以使用的简化流，在没有额外授权代码交换步骤的情况下立即返回访问令牌。据/p> <p>通常不建议使用隐式流(有些服务器完全禁止此流)。自从最初编写规范以来，行业最佳实践已经改变，建议公共客户端应该使用带有PKCE扩展的授权代码流。</p> <h3 id="mandatory-properties-1">强制性的属性据span title="Copy link to clipboard"></span></h3> <ul> <li>资源服务器URL.据/li> <li>客户ID据/li> </ul> <p>注意：尚不支持PKCE据/p> </details> <details> <summary>客户端的验证授权据/summary> <p>资源所有者密码凭据授予类型适用于资源所有者与客户端的信任关系，例如设备操作系统或高度特权的应用程序。授权服务器在启用此授权类型时应特别小心，只有当其他流量不可行时允许它。看据a href="https://tools.ietf.org/html/rfc6749">https://tools.ietf.org/html/rfc6749#4.3据/a>了解更多信息。据/p> <h3 id="mandatory-properties-2">强制性的属性据span title="Copy link to clipboard"></span></h3> <ul> <li>资源服务器URL.据/li> <li>用户名据/li> <li>密码据/li> </ul> </details> <details> <summary>客户端凭据据/summary> <p>当应用程序请求访问令牌访问自己的资源时，不代表用户访问客户端凭据授予。客户需要为此请求进行身份验证。通常，该服务将允许其他请求参数客户端ID和客户端密钥，或接受HTTP基本AUTH标头中的客户端ID和客户端密钥。</p> <h3 id="mandatory-properties-3">强制性的属性据span title="Copy link to clipboard"></span></h3> <p>资源服务器URL.据/p> </details> <h3 id="additional-oauth-properties">其他OAuth属性据span title="Copy link to clipboard"></span></h3> <p>除了身份验证屏幕的OAuth部分中的属性外，还有一些高级选项可以帮助您配置应用程序的OAuth流。据/p> <ul> <li><strong>jsonpostbodies.据/strong>支持JSON格式的OAuth授权服务器请求和响应据/li> <li><strong>OAuthCustomField据/strong>—应发送到授权服务器的任何附加参数据/li> </ul> <div class="block-callout info"> <h3>笔记据span title="Copy link to clipboard"></span></h3> <p>在大多数情况下，除了隐式授权类型之外，可以使用宏绕过OAuth身份验证。如果您在使用InsightAppSec配置OAuth时遇到问题，应该尝试据a href="//www.gcpym.com/insightappsec/authentication">宏观的身份验证据/a>．据/p> </div> </details> <details> <summary>阿达尔据/summary> <p>您可以使用Azure Active Directory身份验证库（ADAL）对您的InsightappSec扫描进行身份验证。据/p> <h4 id="configure-adal">配置ADAL.据span title="Copy link to clipboard"></span></h4> <p>要配置ADAL身份验证，必须转到据strong>身份验证> ADAL.据/strong>屏幕在“扫描配置向导”中，并设置以下选项：据/p> <ul> <li><strong>资源ID据/strong>-这取决于Azure Active Directory (AD)的使用情况。如果你正在使用Azure Native AD，这应该是两个默认值之一，graph.windows.net或graph.microsoft.com。如果您没有使用原生Azure AD，您的AD管理员可能会帮助您为实例获取正确的ID。</li> <li><strong>租户据/strong>-Azure广告租户的域名，例如example.onmicrosoft.com。这可以在Azure Active Directory概览屏幕上找到。据/li> <li><strong>客户ID据/strong>-您已注册的应用程序下的应用程序（客户端）ID。据/li> <li><strong>权威网址据/strong>- 默认为据a href="https://login.microsoftonline.com/">https://login.microsoftonline.com/据/a>如果空着，这个就会被忽略。据/li> <li><strong>用户名据/strong>- 如果您使用的是客户端ID，用户名和密码身份验证流程，这将是您帐户的用户名。据/li> <li><strong>密码据/strong>- 密码不是用户帐户的密码，而是它是“证书和秘密”部分下创建的密钥。您可以将ADAL与OAuth一起使用，作为身份验证协议（参考：据a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-oauth2-implicit-grant-flow">https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-oauth2-implict-grant-flow.据/a>）。据/li> </ul> </details> <h2 id="configure-login-and-logout-settings">配置登录和注销设置据span title="Copy link to clipboard"></span></h2> <p>在尝试经过身份验证的应用程序时，InsightappSec需要一种方法可以知道身份验证成功。它试图通过检查网页的标题和正文来推导应用程序的登录状态。身份验证>高级选项卡中的字段可用于培训InsightAppsec以识别应用程序的登录状态。</p> <details> <summary>假定登录良好据/summary>有时你可能无法找到匹配应用程序登录状态的正则表达式。可能有多个登录链接通向产品的不同区域，InsightAppSec可能试图在所有地方使用相同的凭据，导致账户锁定。您可以启用“**假设良好登录**”开关，提示InsightAppSec在首次登录后不检查登录状态。</details> <details> <summary>登录链接正则表达式据/summary>与指向登录页的链接上的文本匹配的正则表达式。InsightAppSec将使用此正则表达式查找登录链接并应用用户提供的凭据。如果用户已登录，此正则表达式将帮助InsightAppSec避免再次意外爬网登录。据/details> <details> <summary>登录Regex据/summary>如果页面上的文本与此正则表达式匹配，Insightappsec会假定您仍然登录。此正则表达式通常与退出链接匹配，因为签名选项仅在用户仍登录时可用。据/details> <details> <summary>登录页眉正则表达式据/summary>如果用户登录时应用程序始终填充特定的HTTP头，则可以在此字段中使用匹配的正则表达式。如果标头与正则表达式匹配，InsightAppSec将假定用户已登录。据/details> <p>您可以使用Regex Builder据a href="https://blog.rapid7.com/2018/06/14/new-insightappsec-releases-compliance-reports-and-the-appsec-toolkit/">Rapid7 AppSec工具包据/a>在使用InsightappSec中使用它们之前测试正则表达式。据/p> </div> <div class="feedback "> <div class="feedback__title"> 这页对你有帮助吗？据/div> <button class="feedback__yes flex flex-ai-c"><img src="//www.gcpym.com/Areas/Docs/includes/img/icon-thumbs-up.svg">是的据/button> <button class="feedback__no flex flex-ai-c"><img src="//www.gcpym.com/Areas/Docs/includes/img/icon-thumbs-up.svg">没有据/button> </div> <div class="postnav"> <a href="//www.gcpym.com/insightappsec/how-to-configure-scan-scope" class="postnav__link prev"> <div class="postnav__icon"> <i class="r7-icon r7-icon-arrow-chevron-right"></i> </div> <div class="postnav__text"> <div class="postnav__parent"> 识别风险据/div> <div class="postnav__post"> 如何使用扫描范围据/div> </div></a> <a href="//www.gcpym.com/insightappsec/attack-templates" class="postnav__link next"> <div class="postnav__text"> <div class="postnav__parent"> 识别风险据/div> <div class="postnav__post"> 攻击模板据/div> </div> <div class="postnav__icon"> <i class="r7-icon r7-icon-arrow-chevron-right"></i> </div></a> </div> </div> </div> </div> <div class="postnav-border"></div> </div> </div> <footer class="footer"> <div class="container wrapper"> <section class="footer__links"> <div class="footer__links-wrapper"> <div class="footer__links-col"> <div class="footer__links-section footer__contact"> <a href="https://www.rapid7.com"><img alt="rapt7标志“class="logo" data-src="/Areas/Docs/includes/img/r7-nav/Rapid7_logo.svg" src="//www.gcpym.com/Areas/Docs/includes/img/r7-nav/Rapid7_logo.svg"></a> <div class="footer__links-title"> 客户支持据/div> <a class="link" href="tel:1-866-390-8113">+ 1-866-390-8113(免费)据/a> <div class="footer__links-title"> 销售支持据/div> <a class="link" href="tel:866-772-7437">+ 1-866-772-7437（免费电话）据/a> <div class="footer__breach"> <div class="footer__breach-title"> 需要立即帮助解决一个缺口?据/div> <div class="footer__breach-contact"> <div class="footer__breach-icon"></div> <div class="footer__breach-phone"> <a href="tel:18447274347">+ 1-844-727-4347据/a> </div> </div> </div> </div> <div class="footer__links-section footer__solutions"> <div class="footer__links-title"> 解决据/div> <a class="link" href="https://www.rapid7.com/solutions">所有解决方案据/a> <a class="link" href="https://www.rapid7.com/solutions/industry">行业解决方案据/a> <a class="link" href="https://www.rapid7.com/solutions/compliance/">法规遵从性解决方案据/a> </div> </div> <div class="footer__links-col"> <div class="footer__links-section footer__support"> <div class="footer__links-title"> 支持和资源据/div> <a class="link" href="https://www.rapid7.com/for-customers">产品支持据/a> <a class="link" href="https://www.rapid7.com/resources">资源库据/a> <a class="link" href="https://www.rapid7.com/about/customers">客户故事据/a> <a class="link" href="https://www.rapid7.com/about/events-webcasts">活动和网络广播据/a> <a class="link" href="https://www.rapid7.com/services/training-certification">培训和认证据/a> <a class="link" href="https://www.rapid7.com/fundamentals">IT与安全基础知识据/a> <a class="link" href="https://www.rapid7.com/db">漏洞与利用数据库据/a> </div> <div class="footer__links-section footer__about"> <div class="footer__links-title"> 关于我们据/div> <a class="link" href="https://www.rapid7.com/about/company">单位据/a> <a class="link" href="https://www.rapid7.com/about/leadership">领导层据/a> <a class="link" href="https://www.rapid7.com/about/social-good/">社会美好据/a> <a class="link" href="https://www.rapid7.com/about/news">新闻和新闻稿据/a> <a class="link" href="https://www.rapid7.com/about/customers">顾客据/a> <a class="link" href="https://www.rapid7.com/about/public-policy">公共政策据/a> <a class="link" href="https://www.rapid7.com/open-source/">开源据/a> <a class="link" href="https://investors.rapid7.com/">投资者据/a> </div> </div> <div class="footer__links-col"> <div class="footer__links-section footer__connect"> <div class="footer__links-title"> 联系我们据/div> <a class="link" href="https://www.rapid7.com/contact">接触据/a> <a class="link" href="https://blog.rapid7.com/">博客据/a> <a class="link" href="https://support.rapid7.com/">支持登录据/a> <a class="link" href="https://www.rapid7.com/careers">职业生涯据/a> <div class="footer__links-social"> <a class="linkedin" href="https://www.linkedin.com/company/39624" target="_blank"></a> <a class="twitter" href="https://twitter.com/Rapid7" target="_blank"></a> <a class="facebook" href="https://www.facebook.com/rapid7" target="_blank"></a> <a class="instagram" href="https://www.instagram.com/rapid7/" target="_blank"></a> </div> </div> </div> </div> </section> </div> <section class="footer__legal"> <div class="container wrapper"> <div class="footer__legal-copyright"> 必威靠谱 </div> <div class="footer__legal-link"> <a href="https://www.rapid7.com/legal">法律术语据/a> </div>|据div class="footer__legal-link"> <a href="https://www.rapid7.com/privacy-policy">隐私政策据/a> </div>|据div class="footer__legal-link"> <a href="https://www.rapid7.com/export-notice">出口通知据/a> </div>|据div class="footer__legal-link"> <a href="https://www.rapid7.com/trust">信任据/a> </div> </div> </section> </footer> <div id="react_0HMBM66V3BCCK"></div>  <noscript> <iframe src="https://www.gcpym.com/ns.html?id=GTM-WBTPTVC" height="0" width="0" style="display:none;visibility:hidden"></iframe> </noscript>  <div style="text-align:center;margin-bottom:5px;"><form action="http://www.baidu.com/baidu" target="_blank"><div bgcolor="#FFFFFF" style="text-align:center;"><input name="tn" type="hidden" value="baidu"><a href="http://www.baidu.com/"><img src="http://img.baidu.com/img/logo-80px.gif" width="80px" height="29px" alt="Baidu" align="bottom" border="0"></a><input type="text" name="word" size="30" placeholder="" value=""><input type="submit" value="百度搜索"></div></form></div><div id="so360" style="text-align:center;margin-bottom:5px;"><form action="https://www.so.com/" target="_blank" id="so360form"><img src="http://p1.qhimg.com/d/_onebox/search.png" width="100px" height="25px"> <input type="text" autocomplete="off" name="q" id="so360_keyword" placeholder="" value=""> <input type="submit" id="so360_submit" value="360搜索"> <input type="hidden" name="ie" value="gbk"><input type="hidden" name="src" value="zz"> <input type="hidden" name="site" value="so.com"> <input type="hidden" name="rg" value="1"></form></div><div id="sogou" style="text-align:center;margin-bottom:5px;"><form action="https://www.sogou.com/" target="_blank" id="so360form"><img src="https://www.sogou.com/web/index/images/logo_440x140.v.4.png" width="100px" height="25px"> <input type="text" autocomplete="off" name="q" id="sogou.com_keyword" placeholder="" value=""> <input type="submit" id="sogou_submit" value="搜狗"> <input type="hidden" name="ie" value="gbk"><input type="hidden" name="src" value="zz"> <input type="hidden" name="site" value="so.com"> <input type="hidden" name="rg" value="1"></form></div></body> </html>