Skip to main content
Mohammedsalhi
Explorer
August 23, 2025
Question

FortiWeb User Tracking not matching the requested URL

  • August 23, 2025
  • 4 replies
  • 762 views

Dear Team ,

 

Using the following http://testasp.vulnweb.com/, I'm attempting to set up user tracking so that I can see the username in the logs and use brute force based on the username attampts rather than the session. However, it is not working, so I'm not sure what the problem might be.

This screen shot may be helpful.11.jpg

4 replies

funkylicious
SuperUser
SuperUser
August 23, 2025

hi,

did you follow the guide as for setting user tracking like for example described here, https://docs.fortinet.com/document/fortiweb/7.0.3/administration-guide/902681/tracking ?

"jack of all trades, master of none"
Mohammedsalhi
Explorer
August 25, 2025

Yes but it did not match the username.22.jpg

funkylicious
SuperUser
SuperUser
August 26, 2025

i would try with Authentication URL as /login , Logoff path as /logout and for Auth Result condition table, i would configure as per https://help.fortinet.com/fweb/561/Content/FortiWeb/fortiweb-admin/user_tracking.htm 

"jack of all trades, master of none"
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!