topic Re: Where does User Credential Detection search? in General Topics

Where does User Credential Detection search?

djr — Thu, 06 Feb 2020 13:13:16 GMT

I have just turned this on and it's coming up with some really useful (and quite scary) alerts but in a few cases, the URL it is flagging up is pretty innocuous and doesn't include anything resembling the user name or password, so what is it matching on? Is it possibly searching cookie content as well?

In an example I have followed up, the URL is for a login page so it stands to reason that credentials are being sent at some point, but the credential-detected flag is against a URL which just goes to the login page. Cookies would explain it, but I just wondered if there is an explanation anywhere stating what this feature searches?

Thanks

Re: Where does User Credential Detection search?

reaper — Thu, 06 Feb 2020 21:49:32 GMT

it looks in the post message sent when you enter credentials and click logon

the url will be the logon page, the payload the user details

Re: Where does User Credential Detection search?

djr — Tue, 11 Feb 2020 09:27:35 GMT

Ah. I didn't spot the POST in the session details.

Many thanks