Authenticated scan error.

[Th3l3mic]

Hi! I 'm trying unsuccessfully to perform authenticated scanning on a locally hosted DVWA, and no matter what I do with the secret file, I receive an error: "field dynamic not found in type templates" :(

Probably Im doing something wrong :/

Below screenshots from the secret file and login.yaml

Thank you in advance for your help.

[GeorginaReeder]

Hey @Th3l3mic ! Sure, let's take a look into this :)

The '"field dynamic not found in type templates"' error usually shows up when Nuclei can’t understand or properly parse something in your secret file, specifically when trying to use authentication (like tokens, sessions, etc.) via the secret.yaml file.

First thing - I can see that there's a dynamic: field in your secret file. It could be that the field isn't supported in the version of Nuclei you're using, or you're using the wrong syntax for dynamic authentication.

So I'd say definitely check your Nuclei version first and update to the latest version. After that, check your secret file and make sure it looks like this:

id: dvwa-auth

type: http

authentication:
  - type: jwt
    token: "{{token}}"
    header: Authorization

  - type: cookie
    cookie: "PHPSESSID={{session_id}}"

But for dynamic login (like posting to /login.php), it should look more like this:

id: dvwa-auth

type: http

authentication:
  - type: header
    header: Cookie
    value: "PHPSESSID={{session_id}}"

  - type: bearer
    token: "{{token}}"

variables:
  session_id:
    type: internal
    method: POST
    url: http://localhost/login.php
    body: "username=admin&password=password&Login=Login"
    extract:
      type: regex
      regex:
        - 'PHPSESSID=([a-zA-Z0-9]+)'

Either way, everything is under variables: and authentication: instead of dynamic:.

Let us know if that helps or not, and we can then take a closer look!

[Th3l3mic]

Thank you very much Georgina for the quick response. I'm using version 3.4.2, and I tried both the above options, but this time I'm getting the error:
[FTL] Could not run nuclei: could not create auth provider: no secrets in given provider. :(

[Th3l3mic]

In case if someone has the same problem: I reverted to version 3.4.0 and it worked, but still with more complex templates, it doesn't detect obvious vulnerabilities in DVWA :/

[GeorginaReeder]

No worries at all - I'm glad to hear reverting the version worked, but we'll keep looking into the more complex templates.

[nouredinekn]

do u solve this problem