the ncsvc switch didnt seem to do anything different.... In terms of the DSID cookie - i am exactly sure how to generate it. We use the junos client on Macs/iPhones and the Network Connect client in windows. We dont necessarily login from a browser. If i do try to hit that page from a web browser it shows loading components *Host Checker" and if i view the cookies i see the following: opentoken DSSigninURL DSSIGNIN DSPREAUTH DSLAUNCHURL DSHCSTARTED -------------Ran with nscvc ------------- openconnect --juniper --useragent ncsvc --dump https://vpn.mycompany.com/mycompany WARNING: Juniper Network Connect support is experimental. It will probably be superseded by Junos Pulse support. GET https://vpn.mycompany.com/mycompany Attempting to connect to server 65.210.57.16:443 Connected to 65.210.57.16:443 SSL negotiation with vpn.mycompany.com Connected to HTTPS on vpn.mycompany.com > GET /mycompany HTTP/1.1 > Host: vpn.mycompany.com > User-Agent: ncsvc > Connection: close > NCP-Version: 3 > Got HTTP response: HTTP/1.1 302 Found Location: https://vpn.mycompany.com/dana-na/auth/url_default/welcome.cgi Content-Type: text/html; charset=utf-8 Set-Cookie: DSSIGNIN=url_default; path=/dana-na/; expires=Thu, 31-Dec-2037 00:00:00 GMT; secure Set-Cookie: DSIVS=; path=/; expires=Thu, 01 Jan 1970 22:00:00 GMT; secure Set-Cookie: DSSignInURL=/mycompany; path=/; secure Connection: close Content-Length: 0 HTTP body length: (0) GET https://vpn.mycompany.com/dana-na/auth/url_default/welcome.cgi SSL negotiation with vpn.mycompany.com Connected to HTTPS on vpn.mycompany.com > GET /dana-na/auth/url_default/welcome.cgi HTTP/1.1 > Host: vpn.mycompany.com > User-Agent: ncsvc > Cookie: DSSIGNIN=url_default; DSSignInURL=/mycompany > Connection: close > NCP-Version: 3 > Got HTTP response: HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Set-Cookie: DSHCSTARTED=1; path=/dana-na/; secure Date: Tue, 24 Jan 2017 21:37:46 GMT Connection: close Pragma: no-cache Cache-Control: no-store Expires: -1 X-Frame-Options: SAMEORIGIN HTTP body http 1.0 (-1) SSL socket closed uncleanly < < <html> < <head> < <meta http-equiv="Content-Language"> < <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> < <title>mycompany Secure Access Service - PleaseWait</title> < <script src="/dana-na/css/ds_18dbed3d1620b09fa1f569d8686f36286e503cfa396ed1b07cf35ae4b7454281.js"></script> < <meta name="robots" content="none"> < <script> < WriteCSS(); < </script> < <noscript> < <link rel="stylesheet" href="/dana-na/css/ds_18dbed3d1620b09fa1f569d8686f36286e503cfa396ed1b07cf35ae4b7454281.css"></link> < </noscript> < <script src="/dana-na/js/checkbrowser_18dbed3d1620b09fa1f569d8686f36286e503cfa396ed1b07cf35ae4b7454281.js"></script> < <script src="/dana-na/js/clientSetup_18dbed3d1620b09fa1f569d8686f36286e503cfa396ed1b07cf35ae4b7454281.js"></script><script src="/dana-na/js/intermediate_18dbed3d1620b09fa1f569d8686f36286e503cfa396ed1b07cf35ae4b7454281.js"></script> < <script> < < var error_message = ''; < var start_status = 1; < var check_browser = new CheckBrowser(); < var g_delivery = ''; < var g_checkbCookieSet = false; < var g_HCLoading = 'Host Checker'; < var g_isUAC = '0'; < < function initBulb (component) < { < document.getElementById(component + 'bulb').style.color = "#808080"; < } < < function setSucceeded(component) < { < document.getElementById(component + 'bulb').style.color = "#03CA08"; < setStatus(1); < } < < function setFailed(component) < { < document.getElementById(component + 'bulb').style.color = "#990000"; < setStatus(0); < } < < function setStarted(component) < { < document.getElementById(component).style.fontWeight = "bold"; < } < < function setFinished(component) < { < document.getElementById(component).style.fontWeight = "normal"; < } < function gowelcome() < { < if (g_delivery != '') { < setCheckBrowserCookie (); < } < if (getStatus()) { < document.getElementById('endstatus').innerHTML = 'Components loaded successfully'; < var url = window.location; < if (dsIsVista() || dsIsWinXP()) { < try { < var SetupCtrl; < if (document.deliveryType == 'java') { < var doc = getIFrameDocument("controlframe"); < if (typeof(doc) == "undefined") { < return false; < } < SetupCtrl = doc.getElementById("NeoterisSetup"); < } < else if (document.deliveryType == 'activex') { < SetupCtrl = document.getElementById("NeoterisSetup"); < } < if (SetupCtrl != "undefined") { < var data = SetupCtrl.retrieveData("HCDATA"); < if (data && data.indexOf("AED={") != -1) { < // AED getting initialised < var aedParams = aedParseProgressString (data); < var aedInitComplete = 0; < if (aedParams.statusInitialization == gAedProgress.SUCCESS ||aedParams.statusInitialization==gAedProgress.FAIL) { < if (aedParseParam(data, 'HSStatus:')) { < aedInitComplete = 1; < } < } < if (!aedInitComplete) { < if (url.toString().indexOf('?') == -1) { < url += "?type=inter"; < } < else { < url += "&type=inter"; < } < } < } < } < } < catch (e) { < } < } < window.location = url; < } < else { < document.getElementById('endstatus').innerHTML = error_message; < setTimeout("window.location = window.location;", 5000); < } < } < < function setCCSucceeded() < { < setSucceeded('cc'); < } < function setHCSucceeded() < { < setSucceeded('hc'); < } < < function getComponent(component) < { < return document.getElementById(component + 'bulb'); < } < < function failComponents() < { < if (getComponent('hc')) setFailed('hc'); < if (getComponent('cc')) setFailed('cc'); < if (getComponent('ep')) setFailed('ep'); < } < < function setStatus(s) < { < start_status = s; < } < function getStatus() < { < return start_status; < } < function setErrorMessage(aMsg) < { < error_message = aMsg; < } < < function loadIframe(iframeName, url) { < var doc = getIFrameDocument(iframeName); < if (typeof(doc) == "undefined") { < return false; < } < doc.location.href = url; < return true; < } < < function getIFrameDocument(iframeName) { < var fr; < var frWindow; < var frDocument; < if ( window.frames && window.frames[iframeName] ) { < frWindow = window.frames[iframeName]; < }else if (document.getElementById(iframeName) ) { < frWindow = document.getElementById(iframeName).contentWindow; < }else { < return ; < } < < fr = document.getElementById(iframeName); < if (frWindow && frWindow.document) < frDocument = frWindow.document; < else if (fr && fr.contentDocument) < frDocument = fr.contentDocument; < < return frDocument; < } < < function checkb() { < g_delivery = 'none'; g_delivery = 'none'; < if (dsIsActiveXEnabled()){ < g_delivery = 'activex'; < }else if (dsIsJavaEnabled()) { < g_delivery = 'java'; < } document.deliveryType = g_delivery; < return g_delivery; < } < < // Redirect to CGI to download the Setup Client .exe < function redirectToSetupCGI() { < var href = window.location.href; < var redirectURL = "/dana-na/setup/download.cgi?r=" + escape(href); < if (dsIsMac()) { < redirectURL = redirectURL + "&platform=Macintosh"; < } < window.location = redirectURL; < } < < function loadControlFrame() < { < try { < loadIframe ('controlframe', window.location); < } catch (e) { < failComponents(); < setTimeout("gowelcome();", 0); < } < } < < function setCheckBrowserCookie () { < if (g_checkbCookieSet == false) { < document.cookie = "DSCheckBrowser=" + escape(g_delivery) + "; path=/;secure"; < g_checkbCookieSet = true; < } < } < < function submitBrowserInfo() { < setCheckBrowserCookie (); < if (g_delivery == 'none') { < setErrorMessage ('Your browser does not support either ActiveX controls or Java applets. Please contact your administrator.'); < failComponents (); < gowelcome(); < } else { < loadControlFrame(); < } < } < < function startOnLoad() < { < var c = checkb(); < if ((c == 'none') && (dsIsVista() || dsIsWinXP() || dsIsMac())) { < failComponents (); < setTimeout("redirectToSetupCGI();", 7000); < return; < } < setTimeout ("submitBrowserInfo();", 2000);} < </script> < < < < <script> < <!-- < if (window.top != self) { < top.location = location; < } < //--></script> < </head> < < <body bgcolor="#FFFFFF" color="#000000" link="#3366CC" vlink="#CC6699" alink="#3366CC" leftmargin="0" topmargin="0" rightmargin="0" marginwidth="0" marginheight="0" onload="startOnLoad()" > < < < <table id="table_PleaseWait_1" border="0" width="100%" cellspacing="0" cellpadding="3"> < <tr> < <td bgcolor="E3E3E3"><img border="0" src="/dana-na/auth/welcome.cgi?p=logo" alt="Logo"></td> < <td bgcolor="E3E3E3" align="right"> </td> < < </tr> < </table> < <table id="table_PleaseWait_2" cellpadding="0" cellspacing="0" border="0" width="100%"> < <tr> < <td bgcolor="#000000" colspan="2"><img border="0" src="/dana-na/imgs/space.gif" width="1" height="1"></td> < </tr> < </table> < <blockquote> < <table id="table_PleaseWait_3" border="0" cellpadding="2" cellspacing="0"> < <tr><td nowrap ><font face="verdana,sans-serif" size="3"><b>Loading Components...</b></font></td></tr> < <tr><td nowrap ><font face="verdana,sans-serif" size="2">Please wait. This may take several minutes.</font></td></tr> < </table> < < <table id="table_PleaseWait_4" cellpadding="4" cellspacing="0" border="0" width="100%"> <tr> < <td><img src="/dana-na/imgs/space.gif" width="30" height="1"></td> < <td><span style="font-weight:bold; color:#808080; font-size:135%;" id="hcbulb">•</span></td> < <td width="100%"><span><div id="hc">Host Checker</div></span></td> < </tr> <tr> < <td> </td> < <td> </td> < <tr> < <table id="table_PleaseWait_5" border="0" cellpadding="2" cellspacing="0"> < <tr><td nowrap ><font face="verdana,sans-serif" size="2"> < <div id="continue">If an error prevents a component from loading properly, you can <a href="javascript:void(0)" onclick="javascript:gowelcome();return false;">click here</a> to continue. Not all functionality may be available. </div></font></td></tr> < </table> < </tr> < <tr> < <td><img src="/dana-na/imgs/space.gif" width="30" height="1"></td> < </tr> < <tr> < <td><img src="/dana-na/imgs/space.gif" width="30" height="1"></td> < </tr> < <table id="table_PleaseWait_6" border="0" cellpadding="2" cellspacing="0"> < <tr><td nowrap ><font face="verdana,sans-serif" size="2"><div id="endstatus"></div></font></td></tr> < </table> < </table> < </blockquote> < <OBJECT classid="clsid:F27237D7-93C8-44C2-AC6E-D6057B9A918F" < id=NeoterisSetup codebase="\dana-cached\sc\JuniperSetupClient.cab#version=2,1,1,1" < width=0 height=0 > < </object><p align="left"><iframe id="controlframe" name="controlframe" src="/dana-na/html/blank.html" width="2" height="2" frameborder="0" scrolling="NO"></iframe></p> < < </body> < < </html> Failed to find or parse web form in login page Failed to obtain WebVPN cookie Dustin L Hartung On Tue, Jan 24, 2017 at 3:17 PM, Daniel Lenski <dlenski at gmail.com> wrote: > On Tue, Jan 24, 2017 at 12:16 PM, Dustin Hartung > <dustin.hartung at gmail.com> wrote: >> Thank you for the response and tip. I tried as you said - running it >> with --dump using a user agent and without as there appears to be >> different requirements/rules depending on the device type- the results >> are below: > > Yes, this is pretty typical for Juniper. It appears that your VPN uses > authentication forms that are larded up with JavaScript. > > You might also want to try --useragent ncsvc, which spoofs the UA of > Juniper's official desktop client, and often results in a simpler and > easier-to-parse HTML page. > > For an example of where this works: I use a VPN which authenticates > with "SecureMatrix". With a mobile/desktop UA, it generates a pattern > of images using Java or ActiveX applets and I have to enter the > numbers shown in the applet? but with "ncsvc" it generates a simple > pure-text page that makes it easy to scrape and login automatically > with a Python script (https://github.com/dlenski/smxlogin). > > Also, keep in mind that you can do "manual" external authentication as > described in the OpenConnect manual: > http://www.infradead.org/openconnect/juniper.html > > Basically, just login via the web interface, then show the DSID cookie > in your browser, and run: > > $ openconnect --juniper -C "DSID=foobar12345" vpn.example.com > > -Dan
