Authentication testing framework

Last update: Jul 06, 2022

Overview

What is this

This is a framework designed to test authentication for web applications. While web proxies like ZAProxy and Burpsuite allow authenticated tests, they don't provide features to test the authentication process itself, i.e. manipulating the relevant input fields to identify broken authentication. Most authentication bugs in the wild have been found by manually testing it or writing custom scripts that replicate the behaviour. Raider aims to make testing easier, by providing the interface to interact with all important elements found in modern authentication systems.

Features

Raider has the goal to support most of the modern authentication systems, and for now it has the following features:

Unlimited authentication steps
Unlimited inputs/outputs for each step
Running arbitrary operations when receiving the response
Testing under multiple users
Writing custom operations and plugins

How does it work

Raider treats the authentication as a finite state machine. Each authentication step is a different state, with its own inputs and outputs. Those can be cookies, headers, CSRF tokens, or other pieces of information.

Each application needs its own configuration file for Raider to work. The configuration is written in Hylang. The language choice was done for multiple reasons, mainly because it's a Lisp dialect embedded in Python.

Using Lisp was necessarily since sometimes the authentication can get quite complex, and using a static configuration file would've not been enough to cover all the details. Lisp makes it easy to combine code and data, which is exactly what was needed here.

By using a real programming language as a configuration file gives Raider a lot of power, and with great power comes great responsibility. Theoretically one can write entire malware inside the application configuration file, which means you should be careful what's being executed, and not to use configuration files from sources you don't trust. Raider will evaluate everything inside the .hy files, which means if you're not careful you could shoot yourself in the foot and break something on your system.

Installation

Raider is available on PyPi:

$ pip3 install --user raider

The Documentation is available on Read the Docs.

Comments

Improve Json plugin

Json plugin at the moment is quite rudimentary, and doesn't allow extracting the fields inside easily. This needs to be improved for the tool to be usable for applications which use json
enhancement

opened by danielonsecurity 1
Create an object to deal with POST bodies

At the moment Raider only sends the bodies of POST requests in URL encoded form. This is not enough. Creating a new object to allow sending the data in JSON or other formats is necessary.
enhancement

opened by danielonsecurity 1
Build request templates

Create a new class to hold templates of requests. Those should be used when needing to define multiple similar-looking flows. Instead of redefining each time the same thing with little differences, it'd make the hyfiles cleaner if templates were allowed.
enhancement

opened by danielonsecurity 0
Publish to Pypi

To make it easier to install the application, it needs to be published on pypi so users can just use pip install and not have to deal with the source.
enhancement

opened by danielonsecurity 0
Move input/output classes to plugins

Now there's the modules.py file which contain classes that aren't really modules. Cookie and Header classes also act as inputs/outputs. After some brainstorming, I decided to put them all together and move CookieStore and HeaderStore to structures. Everything else that acts as an input and/or output for a Flow will be defined as a Plugin.
enhancement

opened by danielonsecurity 0
Allow more than one action to be executed in existing operations
For example:

(Grep :regex "TWO_FA_REQUIRED" :action (NextStage "multi_factor") :otherwise (NextStage "get_access_token"))

Instead of having only one allowed action like the NextStage here, it would be useful to add more than one, maybe in a list.
enhancement
opened by danielonsecurity 0
Improve Headers

For now the Header class is rudimentary, and Basicauth/Bearerauth objects are defined to handle the authentication. Those two should be merged in the Header class somehow. So the goal is to make Header more flexible.
bug

opened by danielonsecurity 0
Save and load existing sessions

Instead of authenticating every time from the beginning, build a feature that will allow the user to save the session data and load them later on demand.
enhancement

opened by danielonsecurity 0
Improve PostBody to work recursively

At the moment Raider crashes when dealing with JSON data in the PostBody when some of the nested data is a plugin. This is because only the high level plugins are processed in the JSON body. To solve this, the entire JSON body needs to be parsed so that the plugins nested inside other data structures get processed as well.

opened by danielonsecurity 0
Fix character encoding for Basic Auth

For now the basic authentication probably works only when ASCII encoding is used. Should default to ISO-8859-1 and use UTF-8 when explicitly requested by the server (see https://datatracker.ietf.org/doc/html/rfc7617).
bug

opened by danielonsecurity 0
Manage and create new projects from command line

At the moment the only way to create a new project is to manually edit the configuration files. Make it easier for users to start using raider by asking inputs, creating the boilerplate configuration files, and letting them edit it afterwards.
enhancement

opened by danielonsecurity 0

Releases(v0.2.2)

v0.2.2(Aug 23, 2021)
Split plugins into common, basic, modifiers and parsers.

Add Combine modifier.

Add UrlParser plugin.

Update documentation with new plugin structure.

Source code(tar.gz)
Source code(zip)
v0.2.1(Aug 3, 2021)
Improved the fuzzing module.

Added request templates.

Added Combine and Empty plugins.

Fixed many bugs.

Source code(tar.gz)
Source code(zip)
v0.2.0(Aug 1, 2021)
Added new operations and plugins.

Improved existing operations and plugins.

Implemented sessions, allowing users to save and load authentication data.

Implemented basic fuzzing.

Multiple bug fixes.

Project directory changed from ~/.config/raider/apps to ~/.config/raider/projects.

Updated documentation.

Source code(tar.gz)
Source code(zip)
v0.1.0(Jul 9, 2021)

Private release given to only few people to test before making the project public.
Source code(tar.gz)
Source code(zip)

Owner

DigeeX

Making the Internet a safer place

GitHub Repository

Implements authentication and authorization as FastAPI dependencies

FastAPI Security Implements authentication and authorization as dependencies in FastAPI. Features Authentication via JWT-based OAuth 2 access tokens a

111 Jan 07, 2023

The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS,JWE,JWK,JWA,JWT included.

Authlib The ultimate Python library in building OAuth and OpenID Connect servers. JWS, JWK, JWA, JWT are included. Authlib is compatible with Python2.

3.4k Jan 04, 2023

OpenConnect auth creditials collector.

OCSERV AUTH CREDS COLLECTOR V1.0 Зачем Изначально было написано чтобы мониторить какие данные вводятся в интерфейс ханипота в виде OpenConnect server.

0 Sep 23, 2022

A secure authentication module to validate user credentials in a Streamlit application.

Streamlit-Authenticator A secure authentication module to validate user credentials in a Streamlit application. Installation Streamlit-Authenticator i

336 Dec 31, 2022

Django x Elasticsearch Templates

Django x Elasticsearch Requirements Python 3.7 Django = 3 Elasticsearch 7.15 Setup Elasticsearch Install via brew Install brew tap elastic/tap brew

0 May 22, 2022

Cack facebook tidak login

5 Dec 12, 2021

This app makes it extremely easy to build Django powered SPA's (Single Page App) or Mobile apps exposing all registration and authentication related functionality as CBV's (Class Base View) and REST (JSON)

Welcome to django-rest-auth Repository is unmaintained at the moment (on pause). More info can be found on this issue page: https://github.com/Tivix/d

2.4k Jan 03, 2023

Kube OpenID Connect is an application that can be used to easily enable authentication flows via OIDC for a kubernetes cluster

Kube OpenID Connect is an application that can be used to easily enable authentication flows via OIDC for a kubernetes cluster. Kubernetes supports OpenID Connect Tokens as a way to identify users wh

7 Nov 20, 2022

Authentication Module for django rest auth

django-rest-knox Authentication Module for django rest auth Knox provides easy to use authentication for Django REST Framework The aim is to allow for

878 Jan 04, 2023

Crie seus tokens de autenticação com o AScrypt.

AScrypt tokens O AScrypt é uma forma de gerar tokens de autenticação para sua aplicação de forma rápida e segura. Todos os tokens que foram, mesmo que

0 Jun 24, 2022

This program automatically logs you into a Zoom session at your alloted time

This program automatically logs you into a Zoom session at your alloted time. Optionally you can choose to have end the session at your allotted time.

9 Sep 19, 2022

Basic auth for Django.

2 Mar 25, 2022

Login System Using Django

6 Dec 12, 2021

Strong, Simple, and Precise security for Flask APIs (using jwt)

flask-praetorian Strong, Simple, and Precise security for Flask APIs API security should be strong, simple, and precise like a Roman Legionary. This p

321 Dec 18, 2022

Imia is an authentication library for Starlette and FastAPI (python 3.8+).

Imia Imia (belarussian for "a name") is an authentication library for Starlette and FastAPI (python 3.8+). Production status The library is considered

91 Nov 24, 2022

Simplifying third-party authentication for web applications.

Velruse is a set of authentication routines that provide a unified way to have a website user authenticate to a variety of different identity provider

253 Nov 14, 2022

Easy and secure implementation of Azure AD for your FastAPI APIs 🔒 Single- and multi-tenant support.

220 Jan 05, 2023

examify-io is an online examination system that offers automatic grading , exam statistics , proctoring and programming tests , multiple user roles

examify-io is an online examination system that offers automatic grading , exam statistics , proctoring and programming tests , multiple user roles ( Examiner , Supervisor , Student )

4 Oct 28, 2021

Creation & manipulation of PyPI tokens

PyPIToken: Manipulate PyPI API tokens PyPIToken is an open-source Python 3.6+ library for generating and manipulating PyPI tokens. PyPI tokens are ver

8 Nov 01, 2022

Authware API wrapper for Python 3.5+

AuthwarePy Asynchronous wrapper for Authware in Python 3.5+ View our documentation 📲 Installation Run this to install the library via pip: pip instal

3 Feb 09, 2022