Webinject matching content

This support forum board is for support questions relating to Nagios XI, our flagship commercial network monitoring solution.
Locked
lpereira
Posts: 143
Joined: Thu Jul 27, 2017 4:23 pm

Re: Webinject matching content

Post by lpereira »

scottwilkerson wrote:Your PM stated the new error was
lpereira wrote:

Code: Select all

"WebInject CRITICAL - Test case number 1 failed"
This is different than the error you posted in the thread

Code: Select all

(Return code of 25 for service 'CRONOS' on host 'CRONOS' was out of bounds)
No close element tag [Ln: 14, Col: 57]
Are you 100% sure there are no other fields required to be posted? this could cause it to not authenticate properly.

i figured out that one line has double quotation lines at the end. That's why the out of bound message. After i corrected that. i got the error i mentioned before
Top
scottwilkerson
DevOps Engineer
Posts: 19396
Joined: Tue Nov 15, 2011 3:11 pm
Location: Nagios Enterprises
Contact:
Contact scottwilkerson

Re: Webinject matching content

Post by scottwilkerson »

Are you 100% sure there are no other fields required to be posted with the authentication? This could cause it to not authenticate properly, and likely not return the output you expect.

I also did notice the lack of a / in our examples we were using too

Code: Select all

<testvar varname="LOGIN_URL">http:/XXX.XXX.XXX/csl/check</testvar>
should be

Code: Select all

<testvar varname="LOGIN_URL">http://XXX.XXX.XXX/csl/check</testvar>

Can you run the following and post the output?

Code: Select all

curl -X POST -vvv -d 'login=LOGIN&passwd=PASSWORD' http://XXX.XXX.XXX/csl/check
Former Nagios employee
Creator:
Human Design Website
Get Your Human Design Chart
Top
lpereira
Posts: 143
Joined: Thu Jul 27, 2017 4:23 pm

Re: Webinject matching content

Post by lpereira »

scottwilkerson wrote:Are you 100% sure there are no other fields required to be posted with the authentication? This could cause it to not authenticate properly, and likely not return the output you expect.

I also did notice the lack of a / in our examples we were using too

Code: Select all

<testvar varname="LOGIN_URL">http:/XXX.XXX.XXX/csl/check</testvar>
should be

Code: Select all

<testvar varname="LOGIN_URL">http://XXX.XXX.XXX/csl/check</testvar>

Can you run the following and post the output?

Code: Select all

curl -X POST -vvv -d 'login=LOGIN&passwd=PASSWORD' http://XXX.XXX.XXX/csl/check
here is the output of the command you requested.

Code: Select all

[root@nagios webinject]# curl -X POST -vvv -d 'login=LOGIN&passwd=PASSWORD' http://XXX.XXX.XXX/csl/check
* About to connect() to XXX.XXX.XXX port 80 (#0)
*   Trying XXX.XXX.XXX... connected
* Connected to XXX.XXX.XXX (XXX.XXX.XXX) port 80 (#0)
> POST /csl/check HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: XXX.XXX.XXX
> Accept: */*
> Content-Length: 25
> Content-Type: application/x-www-form-urlencoded
>
* HTTP 1.0, assume close after body
< HTTP/1.0 200 OK
< Server: ZK Web Server
< Pragma: no-cache
< Cache-control: no-cache
< Content-Type: text/html;
< Connection: close
<

        <HTML>
        <HEAD><TITLE></TITLE>
        <META http-equiv=Content-Type content='text/html;'>
        </HEAD>
        <BODY topMargin=0 leftMargin=0>
<Script language=JavaScript type='text/javascript'>alert('Failed'+':'+'Error Input!');self.location.href='/';</Script>
        </BODY></HTML>
* Closing connection #0
Regarding the question. I Think there are no other field required for the authentication. i also checked the missing "/" the script is correct, i accidentally removed one / when i replaced with the X. the xml is fine
Top
scottwilkerson
DevOps Engineer
Posts: 19396
Joined: Tue Nov 15, 2011 3:11 pm
Location: Nagios Enterprises
Contact:
Contact scottwilkerson

Re: Webinject matching content

Post by scottwilkerson »

So the content of the page that was returned is this, which does not contain your match string

Code: Select all

<HTML>
        <HEAD><TITLE></TITLE>
        <META http-equiv=Content-Type content='text/html;'>
        </HEAD>
        <BODY topMargin=0 leftMargin=0>
<Script language=JavaScript type='text/javascript'>alert('Failed'+':'+'Error Input!');self.location.href='/';</Script>
        </BODY></HTML>
Former Nagios employee
Creator:
Human Design Website
Get Your Human Design Chart
Top
lpereira
Posts: 143
Joined: Thu Jul 27, 2017 4:23 pm

Re: Webinject matching content

Post by lpereira »

scottwilkerson wrote:So the content of the page that was returned is this, which does not contain your match string

Code: Select all

<HTML>
        <HEAD><TITLE></TITLE>
        <META http-equiv=Content-Type content='text/html;'>
        </HEAD>
        <BODY topMargin=0 leftMargin=0>
<Script language=JavaScript type='text/javascript'>alert('Failed'+':'+'Error Input!');self.location.href='/';</Script>
        </BODY></HTML>
ok i founded what the error was... the user and password field wasn't the same on your example than the one i have on my web.
[root@nagios webinject]# curl -X POST -vvv -d 'username=USER&userpwd=PASS' http://IP/csl/check
* About to connect() to IP port 80 (#0)
* Trying IP... connected
* Connected to IP (IP) port 80 (#0)
> POST /csl/check HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: IP
> Accept: */*
> Content-Length: 28
> Content-Type: application/x-www-form-urlencoded
>
* HTTP 1.0, assume close after body
< HTTP/1.0 200 OK
< Server: ZK Web Server
< Pragma: no-cache
< Cache-control: no-cache
< Content-Type: text/html;
< Connection: close
<
HTTP/1.0 200 OK
Server: ZK Web Server
Pragma: no-cache
Cache-control: no-cache
Content-Type: text/html;
Connection: close

* Closing connection #0
<html><head><title></title><script language=JavaScript type='text/javascript'>top.location.href='/'</script></head><body></body></html>

i asked a partner and he told me that the string i need to find is under an iFrame. i modified the script (via CLI editing the testcases.xml).

now the check has 2 parts, the first one log in on the web page and the second one, look for the match to string.

Let me show you the code

Code: Select all

<testcases repeat="1">
    id="1"
    description1="short description"
    description2="long description"
    method="post"
    url="http://IP/csl/check"
    postbody="username=USER&userpwd=PASS"
</testcases>

<testcases repeat="1">
  id="2"
    description1="short description"
    description2="long description"
    method="post"
    url="http://IP/csl/desktop"
    verifypositive="<TR><TD class=nrow>Transaction capacity</td><TD>30000/0</td><TD></td></tr>"
    logrequest="yes"
    logresponse="yes"
    sleep="3"
</testcases>
Now, when i run the check i got the following error
(Return code of 25 for service 'CRONOS' on host 'CRONOS' was out of bounds)
Only Comments, PIs and whitespace allowed at end of document [Ln: 10, Col: 1]
Top
ssax
Dreams In Code
Posts: 7682
Joined: Wed Feb 11, 2015 12:54 pm

Re: Webinject matching content

Post by ssax »

What is the output of this command?

Code: Select all

curl -L -X POST -vvv -d 'username=USER&userpwd=PASS' http://IP/csl/check
Try this and see if it works for you:

Code: Select all

<testcases repeat="1">
    <case
    id="1"
    description1="short description"
    description2="long description"
    method="post"
    url="http://IP/csl/check"
    postbody="username=USER&userpwd=PASS"
    />

    <case
    id="2"
    description1="short description"
    description2="long description"
    method="post"
    url="http://IP/csl/desktop"
    verifypositive="\<TR>\<TD class=nrow>Transaction capacity\</td>\<TD>30000/0\</td>\<TD>\</td>\</tr>"
    logrequest="yes"
    logresponse="yes"
    sleep="3"
    />
</testcases>
Top
lpereira
Posts: 143
Joined: Thu Jul 27, 2017 4:23 pm

Re: Webinject matching content

Post by lpereira »

ssax wrote:What is the output of this command?

Code: Select all

curl -L -X POST -vvv -d 'username=USER&userpwd=PASS' http://IP/csl/check
Try this and see if it works for you:

Code: Select all

<testcases repeat="1">
    <case
    id="1"
    description1="short description"
    description2="long description"
    method="post"
    url="http://IP/csl/check"
    postbody="username=USER&userpwd=PASS"
    />

    <case
    id="2"
    description1="short description"
    description2="long description"
    method="post"
    url="http://IP/csl/desktop"
    verifypositive="\<TR>\<TD class=nrow>Transaction capacity\</td>\<TD>30000/0\</td>\<TD>\</td>\</tr>"
    logrequest="yes"
    logresponse="yes"
    sleep="3"
    />
</testcases>
no luck

Code: Select all

> Content-Length: 28
> Content-Type: application/x-www-form-urlencoded
>
* HTTP 1.0, assume close after body
< HTTP/1.0 200 OK
< Server: ZK Web Server
< Pragma: no-cache
< Cache-control: no-cache
< Content-Type: text/html;
< Connection: close
<
HTTP/1.0 200 OK
Server: ZK Web Server
Pragma: no-cache
Cache-control: no-cache
Content-Type: text/html;
Connection: close

* Closing connection #0
<html><head><title></title><script language=JavaScript type='text/javascript'>top.location.href='/'</script></head><body></body></html>

Code: Select all

[root@nagios webinject]# /usr/local/nagios/libexec/check_webinject.sh CRONOS__CRONOS_config.xml
could not find ParserDetails.ini in /usr/lib64/perl5/XML/SAX
Use of uninitialized value $case{"postbody"} in string at ./webinject.pl line 611.
WebInject CRITICAL - Test case number 2 failed |time=10.132;30;;0
Top
ssax
Dreams In Code
Posts: 7682
Joined: Wed Feb 11, 2015 12:54 pm

Re: Webinject matching content

Post by ssax »

What is the output of this command?

Code: Select all

/usr/local/nagiosxi/etc/components/webinject/webinject.pl -c CRONOS__CRONOS_config.xml
Top
lpereira
Posts: 143
Joined: Thu Jul 27, 2017 4:23 pm

Re: Webinject matching content

Post by lpereira »

ssax wrote:What is the output of this command?

Code: Select all

/usr/local/nagiosxi/etc/components/webinject/webinject.pl -c CRONOS__CRONOS_config.xml
i have made some modifications on the xml, still not working. The ouput of the command is

Code: Select all

[root@nagios libexec]# /usr/local/nagiosxi/etc/components/webinject/webinject.pl -c CRONOS__CRONOS_config.xml
could not find ParserDetails.ini in /usr/lib64/perl5/XML/SAX
< character not allowed in attribute values [Ln: 16, Col: 86]
Top
ssax
Dreams In Code
Posts: 7682
Joined: Wed Feb 11, 2015 12:54 pm

Re: Webinject matching content

Post by ssax »

< character not allowed in attribute values [Ln: 16, Col: 86]
That error is related to the < in the verifypositive entry that I escaped in the one I sent you, please send me these files:

Code: Select all

/usr/local/nagiosxi/etc/components/webinject/CRONOS__CRONOS_config.xml
/usr/local/nagiosxi/etc/components/webinject/CRONOS__CRONOS_testdata.xml
Top
Locked

Return to “Nagios XI”