Skip to main content

cURL Sequence Authentication with Escape

Description

The 'cURL Sequence' authentication preset facilitates complex authentication flows by executing a templated sequence of cURL requests:

  • Templated cURL Requests: Enables the definition of a sequence of cURL requests, where each request can be templated with variables.
  • Dynamic Token Extractions: Variables are dynamically extracted from the responses of these requests, allowing for sequential data dependency across requests.
  • Token Re-injection: Extracted tokens or variables can be reinjected into subsequent authenticated requests.
  • User-Specific Variables: Supports defining user-specific variables that can be injected into the cURL sequences.

This preset is particularly useful for complex authentication scenarios where multiple steps or interactions are required, and where each step might depend on the outcome of the previous one.

Warning: This preset requires to name your variables in order to be able to extract and inject them properly in the templates or the final injections.

Examples

presets:
- type: curl_sequence
requests:
- curl: curl -X POST https://api.example.com/login -d "username={{username}}&password={{password}}"
extractions:
- name: session_id
key: SessionID
location: cookie
- name: csrfToken
key: X-CSRF-Token
location: header
- curl: 'curl -X POST https://auth.example.com/token?session_id={{session_id}}
-H "X-CSRF-Token: {{csrfToken}}"'
extractions:
- name: bearerToken
key: bearer
location: body
injections:
- key: X-CSRF-Token
location: header
variable: csrfToken
- key: Authorization
location: header
prefix: Bearer
variable: bearerToken
users:
- username: user1
variables:
username: user1
password: user1Password
- username: admin2
variables:
username: user2
password: user2Password

Extensive Configuration

PropertyTypeRequiredDescriptionReference
typeConst[curl_sequence]True
userscURLSequenceUserPresetTrueThe list of users to generate tokens for.cURLSequenceUserPreset
requestscURLSequenceRequestPresetTrueA sequence of curl templates used to make requests and extract variables.cURLSequenceRequestPreset
injectionsTokenInjectionFalseFinal variables injected into the authentified requests.TokenInjection

Objects

cURLSequenceUserPreset

PropertyTypeRequiredDescriptionReference
usernamestringTrueThe arbitrary name that identifies the user.
headersDict[string, string]FalseOptional headers injected during the authentication process and in authentified requests.
cookiesDict[string, string]FalseOptional cookies injected during the authentication process and in authentified requests.
variablesDict[string, string]FalseA dict of variables to inject into the cURL sequences.

cURLSequenceRequestPreset

PropertyTypeRequiredDescriptionReference
curlstringTrueA curl template used to make a request.
extractionsTokenExtractionFalseVariables extracted from the response that can be templated in further requests.TokenExtraction

TokenInjection

PropertyTypeRequiredDescriptionReference
locationHTTPLocationTrueThe location of the HTTP request where the token should be injectedHTTPLocation
keystringTrueThe key to use for the injected token. Its usage depends on the location. For headers, cookies,and query parameters, this key describes the name of the header, cookie or query parameter. For a body location, the key is the field where the token should be injected within the request bodies
prefixstringFalseA prefix to prepend to the token before it is injected
variablestringTrueThe name of a variable to retrieve to create the token's value. If not provided, the token will be infered as the first successful extraction of the procedure

TokenExtraction

PropertyTypeRequiredDescriptionReference
locationHTTPLocationTrueThe location of the HTTP request where the value should be extractedHTTPLocation
keystringTrueThe key to use for the extracted value, depending on the location
regexstringFalseThe regex to use to extract the token from the key value. By default the entire value is taken.
namestringTrueThe name of the variable to store the extracted value into

Enums

HTTPLocation

  • header

  • cookie

  • body

  • query