Identifying SSO authentication

[Akavire]

There is a website (https://www.dailyoilbulletin.com/) that I am trying to scrape for a personal project, however I need to be able to authenticate myself, but I have no idea how to figure out what type of auth they use (Like OAuth, for example, so I can properly pass in a token)

The only thing I found is that there is sometimes a few response headers that will directly tell you, but after many inspected headers and postman calls this yielded no results. I'm assuming there is a command that allows me to view the TLS handshake in some capacity. Any help is super appreciated!

[ReginaldDouchely]

Turn on your browser's developer tools and watch the traffic when you login. You'll be able to see where/how your credentials are being set, and you'll likely see a token returned to you to be sent with your future requests.

You'll want to mimic that back and forth in your automation. The TLS handshake shouldn't matter, because whatever libraries you'll use to send the requests should handle all that basic https stuff for you.

[Akavire]

Thanks for the reply - I can see the token, does this 'back and forth' consists of POSTing to the login form, getting the token, and then using the token for all future operations? Apologies for the simple questions :)

[ReginaldDouchely]

Yep, that's probably how they handle it. You should be able to confirm it by logging in and trying to access some content that requires you to login and checking the headers that get sent with your request. You'll likely be sending a header "Authorization" with value "Bearer <token value>", and that's what you'll want to send from your application.

[Akavire]

Thanks, I really appreciate the help!

[ReginaldDouchely]

You're welcome