What is this
This is a framework designed to test authentication for web applications. While web proxies like ZAProxy and Burpsuite allow authenticated tests, they don't provide features to test the authentication process itself, i.e. manipulating the relevant input fields to identify broken authentication. Most authentication bugs in the wild have been found by manually testing it or writing custom scripts that replicate the behaviour. Raider aims to make testing easier, by providing the interface to interact with all important elements found in modern authentication systems.
Note:
Raider is still a work in progress. Bugs and missing features are to be expected. If you find something that doesn't work as expected, open a Github issue and let us know. You can also join the community forum and start asking questions there.
Features
Raider has the goal to support most of the modern authentication systems, and here are some features that other tools don't offer:
- Unlimited authentication steps
- Unlimited inputs/outputs for each step
- Ability to conditionally decide the next step
- Running arbitrary operations when receiving the response
- Easy to write custom operations and plugins
How does it work
Raider treats the authentication as a finite state machine. Each authentication step is a different state, with its own inputs and outputs. Those can be cookies, headers, CSRF tokens, or other pieces of information.
Each application needs its own configuration file for Raider to work. The configuration is written in Hylang. The language choice was done for multiple reasons, mainly because it's a Lisp dialect embedded in Python.
Using Lisp was necessarily since sometimes the authentication can get quite complex, and using a static configuration file would've not been enough to cover all the details. Lisp makes it easy to combine code and data, which is exactly what was needed here.
By using a real programming language as a configuration file gives Raider a lot of power, and with great power comes great responsibility. Theoretically one can write entire malware inside the application configuration file, which means you should be careful what's being executed, and not to use configuration files from sources you don't trust. Raider will evaluate everything inside the .hy files, which means if you're not careful you could shoot yourself in the foot and break something on your system.
Installation
Raider is available on PyPi:
$ pip3 install --user raider
Raider's philosophy
Raider was developed with the following goals:
- To abstract authentication concepts using Python objects.
- To support most modern web authentication features.
- To make it easy to add new features for users.
And if you're looking at the code and willing to contribute, keep those in mind:
- The simpler and cleaner the code, the better.
- New features should be implemented as
PluginsandOperationsif possible. - The
hyfilesshould stay as minimal as possible, while still allowing the user to get creative. In the future parts of this code could be autogenerated.
15 Jul 22, 2022
363 Dec 24, 2022
1.2k Dec 28, 2022
1 Feb 11, 2022
12 Dec 16, 2022
3 Oct 21, 2021
31 Dec 30, 2022
2.7k Jan 01, 2023
1.4k Jan 04, 2023
11 Dec 11, 2022
468 Jan 01, 2023
3 May 16, 2022
49 Nov 25, 2022
3 Aug 18, 2022
35 Dec 14, 2022
0 Apr 26, 2022
1.6k Dec 19, 2022
0 Jan 06, 2022
1.3k Sep 18, 2022
15 Dec 11, 2022