gpt4 book ai didi

Using JMETER, how can I figure out what i'm missing from 2fa request(使用JMETER,我如何才能找出我在2FA请求中遗漏了什么)

转载 作者:bug小助手 更新时间:2023-10-25 11:18:43 25 4
gpt4 key购买 nike



I have a test in JMETER which has to go through duo 2fa authentication. However the account i'm using is set up to bypass the 2fa, so if I use to log in it just moves me right on through to the app.

我在JMETER中有一个测试,它必须通过Duo 2FA认证。然而,我正在使用的账号被设置为绕过2FA,所以如果我使用它登录,只需直接进入应用程序即可。


But when i'm running my tests in JMETER all the calls to my app after that step fail and show 304: forbidden. Of course i'm using the HTTP Cookie Manager and HTTP Cache Manager. I even pulled the cookies with the regular expression extractor and passed them myself and every single cookie I can see in devtools when I login through a browser is being properly passed- yet i'm still getting 304's.

但是,当我在JMETER中运行我的测试时,在该步骤之后对我的应用程序的所有调用都失败,并显示304:禁止。当然,我使用的是HTTP Cookie管理器和HTTP缓存管理器。我甚至用正则表达式解析器提取Cookie并亲自传递,当我通过浏览器登录时,我在DevTools中看到的每一个Cookie都被正确传递--然而我仍然得到了304‘S。


I can also tell that duo is showing the login as accepted. So I feel like i'm not passing something between duo and the app. But if that's the case it doesn't seem to show up anywhere I can see.

我还能看出Duo正在显示登录名为已接受。所以我觉得我没有在Duo和应用程序之间传递什么东西。但如果是这样的话,它似乎不会出现在我能看到的任何地方。


I'm usually doing UI testing so i'm pretty new to JMETER and don't know a ton about how 2FA works behind the scenes. Is there some call i'm missing?

我通常是做用户界面测试的,所以我对JMETER还很陌生,对2FA在幕后是如何工作的也不太了解。我是不是漏掉了什么电话?


I know this is a bit in the show in the dark, but i'm getting desperate. I just don't see anything missing. The log in is good. Duo accepts it. What could I possibly be missing?

我知道这有点不太可能,但我有点绝望了。我就是看不出有什么遗漏。登录状态良好。Duo接受了。我还能错过什么呢?


enter image description here


enter image description here


My only guess is I found this request in the network tab:
enter image description here

我唯一的猜测是,我在网络选项卡中找到了这个请求:


I do not see any requests for this information in the dashboard call, but I thought maybe the tx parameter needed to be passed down? Truly a guess on my part though.

我在仪表板调用中没有看到任何对此信息的请求,但我认为可能需要向下传递tx参数?不过,对我来说,这只是个猜测。


I'm flailing here.

我在这里挥舞。


更多回答
优秀答案推荐

Most probably your login fails due to missing or improperly working correlation.

最有可能的是,您的登录失败是因为缺少关联或关联不正确。


Record the login twice using HTTP(S) Test Script Recorder or JMeter Chrome Extension and compare resulting test scripts. All the values which differ are a subject to correlation: you need to

使用HTTP(S)测试脚本记录器或JMeter Chrome扩展记录登录两次,并比较生成的测试脚本。所有不同的值都是相关的:你需要



  1. extract the dynamic value from the previous response using a suitable JMeter PostProcessor and save it into a JMeter Variable

  2. replace recorded hard-coded value with the JMeter Variable from the previous step


Most probably you need to handle this _xsrf guy:

很可能你需要处理这个_xsrf:


enter image description here


See What is CSRF & How to Load Test CSRF-Protected Websites for example challenge and solution.

有关挑战和解决方案,请参阅什么是CSRF&如何加载受CSRF保护的网站。


更多回答

25 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com