Where is the last login date stored?

[d4t4king]

I am trying to write a script that will audit the web console users similar to the attempt here: https://github.com/rapid7/nexpose-resources/tree/master/scripts/users/audit_users

But one thing I desperately need to check is how long it's been since the user last logged in. It doesn't look like this info is stored with the User or UserSummary objects. It is shown on the web console, so it must be available somewhere?

[gschneider-r7]

I don't believe this information is available in any of the APIs so you'd have to request it the same way the UI does. You can use either AJAX or DataTable methods in the gem for this. You should be able to find the XHR endpoint with that data in browser developer tools while loading the user management page.

[d4t4king]

OK, well, I'm not a web developer nor a web hacker, so this is probably a little outside my wheelhouse.

But, I think I figured it out.

It looks like the table I need is 'UserAdminSynopsis'. So the ruby code might look something like this (???):

myTable = Nexpose::DataTable._get_dyn_table(conn, '/data/admin/users?tableID=UserAdminSynopsis')
ids2logons = Hash.new
myTable.each do |row|
    ids2logons[row["User ID"].to_i] = row["Last Logon"].to_i
end
pp ids2logons

...which should output something like...:

Format (userID=>lastLogonEpoch)
{1=>111111111,
2=>111111112,
3=>111111114,
etc.}

...except that the date strings seems to be 3 digits too long, and if you don't chop off the last 3 digits when converting to DateTime, you get dates ~48,000 years in the future, which is a little strange.

Anyway, I would submit that LastLogon should be an attribute of Nexpose::User (if not also Nexpose::UserSummary) since most, if not all, of the other fields in that table already are.

[My-Random-Thoughts]

I know this is really old, but you could use

https://<IP_OR_NAME>:3780/data/admin/users?printDocType=0&tableID=UserAdminSynopsis

which returns an XML document. The last login is a number like 1554900551010, which is the number of milliseconds since 1970-01-01.

[d4t4king]

I know this is really old, but you could use

https://<IP_OR_NAME>:3780/data/admin/users?printDocType=0&tableID=UserAdminSynopsis

which returns an XML document. The last login is a number like 1554900551010, which is the number of milliseconds since 1970-01-01.

Thanks. We actually migrated off of Rapid7 earlier this year. Hopefully, someone finds this useful in prosperity.