Configuring one-time password (OTP)

Some applications require a one‑time password (OTP) as part of their login process or automatic exploration. AppScan supports OTP‑based authentication, you need to configure the OTP before you record the login or automatic explore sequence for these sites.

About this task

AppScan can authenticate to applications that use:
  • TOTP (Time‑based one‑time passwords) or
    • URL‑generated OTPs (The OTP value is detected from the URL response).
Once configured, AppScan automatically generates and submits the correct OTP during login and throughout the scan.
Limitations:
  • Only one OTP type (TOTP or URL-generated) is supported per scan.
  • For TOTP only numerical values are supported.
  • When OTP is configured, Action-based must be the selected Login playback method in the Login playback. OTP does not work with Request-based login.

Procedure

  1. Navigate to Multi-Factor Authentication (MFA) from the Web full configuration
  2. Select the OTP method used by your application.
    1. TOTP (time‑based): commonly used by authenticator apps
    2. URL‑generated: used by some custom authentication flows
  3. Enter the required parameters for the selected OTP method.
    1. If you selected TOTP, enter the following values:
      1. Secret key
      2. OTP length (number of digits)
      3. Hash algorithm
      4. Time step (in seconds): Interval between password changes.
    2. If you selected URL‑generated OTP, enter the following values:
      1. URL: The URL from which the OTP value will be detected.
      2. Regular expression: Enter the specific regular expression used to extract the correct value and click Validate.
  4. Review or add HTTP parameters as needed.

    During the login analysis of a recorded login, AppScan detects this parameter and adds them to the OTP HTTP-parameters list and to the OTP entry in the Automatic Form Fill view. If you are using automatic login, or if this parameter is not part of the login process, you must configure it manually.

  5. Click Apply.

How to identify the OTP HTTP-parameter

About this task

AppScan needs to identify the OTP (One-Time Password) parameter to successfully log into your application. AppScan typically detects this parameter automatically when validating your login procedure. However, if automatic detection fails, you're using Automatic Login, or the detected parameter isn't relevant to your login process, you'll need to configure the OTP parameter manually. Without the correct OTP parameter, AppScan cannot complete the login process during security scanning, which prevents proper application analysis.

Procedure

  1. Open a browser and go to your application's login page.
  2. Click F12 to open the developer tools pane of the browser (opens to the right of, or underneath, the main browser pane).
  3. Click on the Elements tab to view the HTML code. When you select a part of the code, the element is highlighted in the main browser pane.
  4. Locate the element that highlights the OTP field.
    Example:
    <input type="text" name="OTPvalue" value="">
  5. The value of the name parameter, without the quotation marks, is the OTP HTTP parameter you need.
    Example:
    OTPvalue
  6. If there is more than one OTP HTTP parameter, click Add another to add additional fields as needed.

Record the login, verify OTP, and run the scan

Procedure

  1. Record the login procedure:
    1. Go to Login management, and click Record login sequence > AppScan browser.
    2. Enter your username and password.
    3. When prompted for the OTP, use the value that AppScan provides.
    4. Click Login.
    5. Once you are successfully logged in, click Analyze login. A confirmation "Login sequence recorded" appears.
  2. Verify OTP integration:
    1. Return to the OTP view.
    2. Confirm that the OTP HTTP parameter has been added automatically.
    3. Open Automatic Form Fill to verify that the parameter is also listed there.
    4. Click Validate to check AppScan replay the login to ensure the OTP is correctly submitted.
  3. Start the scan:
    1. Once the login and OTP configuration are validated, you can:
      1. Start full scan, or
      2. Explore only to observe the crawl behavior
    2. AppScan automatically generates and submits OTPs during authentication throughout the scan.

    By configuring OTP settings and recording the login sequence, AppScan can successfully authenticate to applications that require one‑time passwords. This ensures complete scan coverage for sites protected by multi‑factor authentication.