Failed to obtain WebVPN cookie
Dustin Hartung
dustin.hartung at gmail.com
Tue Jan 24 13:53:56 PST 2017
the ncsvc switch didnt seem to do anything different.... In terms of
the DSID cookie - i am exactly sure how to generate it. We use the
junos client on Macs/iPhones and the Network Connect client in
windows. We dont necessarily login from a browser. If i do try to
hit that page from a web browser it shows loading components *Host
Checker" and if i view the cookies i see the following:
opentoken
DSSigninURL
DSSIGNIN
DSPREAUTH
DSLAUNCHURL
DSHCSTARTED
-------------Ran with nscvc -------------
openconnect --juniper --useragent ncsvc --dump
https://vpn.mycompany.com/mycompany
WARNING: Juniper Network Connect support is experimental.
It will probably be superseded by Junos Pulse support.
GET https://vpn.mycompany.com/mycompany
Attempting to connect to server 65.210.57.16:443
Connected to 65.210.57.16:443
SSL negotiation with vpn.mycompany.com
Connected to HTTPS on vpn.mycompany.com
> GET /mycompany HTTP/1.1
> Host: vpn.mycompany.com
> User-Agent: ncsvc
> Connection: close
> NCP-Version: 3
>
Got HTTP response: HTTP/1.1 302 Found
Location: https://vpn.mycompany.com/dana-na/auth/url_default/welcome.cgi
Content-Type: text/html; charset=utf-8
Set-Cookie: DSSIGNIN=url_default; path=/dana-na/; expires=Thu,
31-Dec-2037 00:00:00 GMT; secure
Set-Cookie: DSIVS=; path=/; expires=Thu, 01 Jan 1970 22:00:00 GMT; secure
Set-Cookie: DSSignInURL=/mycompany; path=/; secure
Connection: close
Content-Length: 0
HTTP body length: (0)
GET https://vpn.mycompany.com/dana-na/auth/url_default/welcome.cgi
SSL negotiation with vpn.mycompany.com
Connected to HTTPS on vpn.mycompany.com
> GET /dana-na/auth/url_default/welcome.cgi HTTP/1.1
> Host: vpn.mycompany.com
> User-Agent: ncsvc
> Cookie: DSSIGNIN=url_default; DSSignInURL=/mycompany
> Connection: close
> NCP-Version: 3
>
Got HTTP response: HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Set-Cookie: DSHCSTARTED=1; path=/dana-na/; secure
Date: Tue, 24 Jan 2017 21:37:46 GMT
Connection: close
Pragma: no-cache
Cache-Control: no-store
Expires: -1
X-Frame-Options: SAMEORIGIN
HTTP body http 1.0 (-1)
SSL socket closed uncleanly
<
< <html>
< <head>
< <meta http-equiv="Content-Language">
< <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
< <title>mycompany Secure Access Service - PleaseWait</title>
< <script src="/dana-na/css/ds_18dbed3d1620b09fa1f569d8686f36286e503cfa396ed1b07cf35ae4b7454281.js"></script>
< <meta name="robots" content="none">
< <script>
< WriteCSS();
< </script>
< <noscript>
< <link rel="stylesheet"
href="/dana-na/css/ds_18dbed3d1620b09fa1f569d8686f36286e503cfa396ed1b07cf35ae4b7454281.css"></link>
< </noscript>
< <script src="/dana-na/js/checkbrowser_18dbed3d1620b09fa1f569d8686f36286e503cfa396ed1b07cf35ae4b7454281.js"></script>
< <script src="/dana-na/js/clientSetup_18dbed3d1620b09fa1f569d8686f36286e503cfa396ed1b07cf35ae4b7454281.js"></script><script
src="/dana-na/js/intermediate_18dbed3d1620b09fa1f569d8686f36286e503cfa396ed1b07cf35ae4b7454281.js"></script>
< <script>
<
< var error_message = '';
< var start_status = 1;
< var check_browser = new CheckBrowser();
< var g_delivery = '';
< var g_checkbCookieSet = false;
< var g_HCLoading = 'Host Checker';
< var g_isUAC = '0';
<
< function initBulb (component)
< {
< document.getElementById(component + 'bulb').style.color = "#808080";
< }
<
< function setSucceeded(component)
< {
< document.getElementById(component + 'bulb').style.color = "#03CA08";
< setStatus(1);
< }
<
< function setFailed(component)
< {
< document.getElementById(component + 'bulb').style.color = "#990000";
< setStatus(0);
< }
<
< function setStarted(component)
< {
< document.getElementById(component).style.fontWeight = "bold";
< }
<
< function setFinished(component)
< {
< document.getElementById(component).style.fontWeight = "normal";
< }
< function gowelcome()
< {
< if (g_delivery != '') {
< setCheckBrowserCookie ();
< }
< if (getStatus()) {
< document.getElementById('endstatus').innerHTML = 'Components loaded
successfully';
< var url = window.location;
< if (dsIsVista() || dsIsWinXP()) {
< try {
< var SetupCtrl;
< if (document.deliveryType == 'java') {
< var doc = getIFrameDocument("controlframe");
< if (typeof(doc) == "undefined") {
< return false;
< }
< SetupCtrl = doc.getElementById("NeoterisSetup");
< }
< else if (document.deliveryType == 'activex') {
< SetupCtrl = document.getElementById("NeoterisSetup");
< }
< if (SetupCtrl != "undefined") {
< var data = SetupCtrl.retrieveData("HCDATA");
< if (data && data.indexOf("AED={") != -1) {
< // AED getting initialised
< var aedParams = aedParseProgressString (data);
< var aedInitComplete = 0;
< if (aedParams.statusInitialization ==
gAedProgress.SUCCESS
||aedParams.statusInitialization==gAedProgress.FAIL) {
< if (aedParseParam(data, 'HSStatus:')) {
< aedInitComplete = 1;
< }
< }
< if (!aedInitComplete) {
< if (url.toString().indexOf('?') == -1) {
< url += "?type=inter";
< }
< else {
< url += "&type=inter";
< }
< }
< }
< }
< }
< catch (e) {
< }
< }
< window.location = url;
< }
< else {
< document.getElementById('endstatus').innerHTML = error_message;
< setTimeout("window.location = window.location;", 5000);
< }
< }
<
< function setCCSucceeded()
< {
< setSucceeded('cc');
< }
< function setHCSucceeded()
< {
< setSucceeded('hc');
< }
<
< function getComponent(component)
< {
< return document.getElementById(component + 'bulb');
< }
<
< function failComponents()
< {
< if (getComponent('hc')) setFailed('hc');
< if (getComponent('cc')) setFailed('cc');
< if (getComponent('ep')) setFailed('ep');
< }
<
< function setStatus(s)
< {
< start_status = s;
< }
< function getStatus()
< {
< return start_status;
< }
< function setErrorMessage(aMsg)
< {
< error_message = aMsg;
< }
<
< function loadIframe(iframeName, url) {
< var doc = getIFrameDocument(iframeName);
< if (typeof(doc) == "undefined") {
< return false;
< }
< doc.location.href = url;
< return true;
< }
<
< function getIFrameDocument(iframeName) {
< var fr;
< var frWindow;
< var frDocument;
< if ( window.frames && window.frames[iframeName] ) {
< frWindow = window.frames[iframeName];
< }else if (document.getElementById(iframeName) ) {
< frWindow = document.getElementById(iframeName).contentWindow;
< }else {
< return ;
< }
<
< fr = document.getElementById(iframeName);
< if (frWindow && frWindow.document)
< frDocument = frWindow.document;
< else if (fr && fr.contentDocument)
< frDocument = fr.contentDocument;
<
< return frDocument;
< }
<
< function checkb() {
< g_delivery = 'none'; g_delivery = 'none';
< if (dsIsActiveXEnabled()){
< g_delivery = 'activex';
< }else if (dsIsJavaEnabled()) {
< g_delivery = 'java';
< } document.deliveryType = g_delivery;
< return g_delivery;
< }
<
< // Redirect to CGI to download the Setup Client .exe
< function redirectToSetupCGI() {
< var href = window.location.href;
< var redirectURL = "/dana-na/setup/download.cgi?r=" + escape(href);
< if (dsIsMac()) {
< redirectURL = redirectURL + "&platform=Macintosh";
< }
< window.location = redirectURL;
< }
<
< function loadControlFrame()
< {
< try {
< loadIframe ('controlframe', window.location);
< } catch (e) {
< failComponents();
< setTimeout("gowelcome();", 0);
< }
< }
<
< function setCheckBrowserCookie () {
< if (g_checkbCookieSet == false) {
< document.cookie = "DSCheckBrowser=" + escape(g_delivery) +
"; path=/;secure";
< g_checkbCookieSet = true;
< }
< }
<
< function submitBrowserInfo() {
< setCheckBrowserCookie ();
< if (g_delivery == 'none') {
< setErrorMessage ('Your browser does not support either
ActiveX controls or Java applets. Please contact your
administrator.');
< failComponents ();
< gowelcome();
< } else {
< loadControlFrame();
< }
< }
<
< function startOnLoad()
< {
< var c = checkb();
< if ((c == 'none') && (dsIsVista() || dsIsWinXP() || dsIsMac())) {
< failComponents ();
< setTimeout("redirectToSetupCGI();", 7000);
< return;
< }
< setTimeout ("submitBrowserInfo();", 2000);}
< </script>
<
<
<
< <script>
< <!--
< if (window.top != self) {
< top.location = location;
< }
< //--></script>
< </head>
<
< <body bgcolor="#FFFFFF" color="#000000" link="#3366CC"
vlink="#CC6699" alink="#3366CC" leftmargin="0" topmargin="0"
rightmargin="0" marginwidth="0" marginheight="0"
onload="startOnLoad()" >
<
<
< <table id="table_PleaseWait_1" border="0" width="100%"
cellspacing="0" cellpadding="3">
< <tr>
< <td bgcolor="E3E3E3"><img border="0"
src="/dana-na/auth/welcome.cgi?p=logo" alt="Logo"></td>
< <td bgcolor="E3E3E3" align="right"> </td>
<
< </tr>
< </table>
< <table id="table_PleaseWait_2" cellpadding="0" cellspacing="0"
border="0" width="100%">
< <tr>
< <td bgcolor="#000000" colspan="2"><img border="0"
src="/dana-na/imgs/space.gif" width="1" height="1"></td>
< </tr>
< </table>
< <blockquote>
< <table id="table_PleaseWait_3" border="0" cellpadding="2"
cellspacing="0">
< <tr><td nowrap ><font face="verdana,sans-serif" size="3"><b>Loading
Components...</b></font></td></tr>
< <tr><td nowrap ><font face="verdana,sans-serif" size="2">Please
wait. This may take several minutes.</font></td></tr>
< </table>
<
< <table id="table_PleaseWait_4" cellpadding="4" cellspacing="0"
border="0" width="100%"> <tr>
< <td><img src="/dana-na/imgs/space.gif" width="30" height="1"></td>
< <td><span style="font-weight:bold; color:#808080; font-size:135%;"
id="hcbulb">•</span></td>
< <td width="100%"><span><div id="hc">Host Checker</div></span></td>
< </tr> <tr>
< <td> </td>
< <td> </td>
< <tr>
< <table id="table_PleaseWait_5" border="0" cellpadding="2"
cellspacing="0">
< <tr><td nowrap ><font face="verdana,sans-serif" size="2">
< <div id="continue">If an error prevents a component from
loading properly, you can <a href="javascript:void(0)"
onclick="javascript:gowelcome();return false;">click here</a> to
continue. Not all functionality may be available.
</div></font></td></tr>
< </table>
< </tr>
< <tr>
< <td><img src="/dana-na/imgs/space.gif" width="30" height="1"></td>
< </tr>
< <tr>
< <td><img src="/dana-na/imgs/space.gif" width="30" height="1"></td>
< </tr>
< <table id="table_PleaseWait_6" border="0" cellpadding="2"
cellspacing="0">
< <tr><td nowrap ><font face="verdana,sans-serif" size="2"><div
id="endstatus"></div></font></td></tr>
< </table>
< </table>
< </blockquote>
< <OBJECT classid="clsid:F27237D7-93C8-44C2-AC6E-D6057B9A918F"
< id=NeoterisSetup
codebase="\dana-cached\sc\JuniperSetupClient.cab#version=2,1,1,1"
< width=0 height=0 >
< </object><p align="left"><iframe id="controlframe"
name="controlframe" src="/dana-na/html/blank.html" width="2"
height="2" frameborder="0" scrolling="NO"></iframe></p>
<
< </body>
<
< </html>
Failed to find or parse web form in login page
Failed to obtain WebVPN cookie
Dustin L Hartung
On Tue, Jan 24, 2017 at 3:17 PM, Daniel Lenski <dlenski at gmail.com> wrote:
> On Tue, Jan 24, 2017 at 12:16 PM, Dustin Hartung
> <dustin.hartung at gmail.com> wrote:
>> Thank you for the response and tip. I tried as you said - running it
>> with --dump using a user agent and without as there appears to be
>> different requirements/rules depending on the device type- the results
>> are below:
>
> Yes, this is pretty typical for Juniper. It appears that your VPN uses
> authentication forms that are larded up with JavaScript.
>
> You might also want to try --useragent ncsvc, which spoofs the UA of
> Juniper's official desktop client, and often results in a simpler and
> easier-to-parse HTML page.
>
> For an example of where this works: I use a VPN which authenticates
> with "SecureMatrix". With a mobile/desktop UA, it generates a pattern
> of images using Java or ActiveX applets and I have to enter the
> numbers shown in the applet… but with "ncsvc" it generates a simple
> pure-text page that makes it easy to scrape and login automatically
> with a Python script (https://github.com/dlenski/smxlogin).
>
> Also, keep in mind that you can do "manual" external authentication as
> described in the OpenConnect manual:
> http://www.infradead.org/openconnect/juniper.html
>
> Basically, just login via the web interface, then show the DSID cookie
> in your browser, and run:
>
> $ openconnect --juniper -C "DSID=foobar12345" vpn.example.com
>
> -Dan
More information about the openconnect-devel
mailing list