2 Star 4 Fork 1

中通技术团队 / secscan-authcheck

加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
克隆/下载
贡献代码
同步代码
取消
提示: 由于 Git 不支持空文件夾,创建文件夹后会生成空的 .keep 文件
Loading...
README
Apache-2.0

越权检测工具

项目介绍

快速开始

部署

越权检测工具

  • 启动服务
cd authcheck
docker-compose up -d
  • 启动示例站点
cd example
# 需要将 docker-compose.yml 中的 your-ip 替换为当前机器的ip,以便访问
docker-compose up -d

流量捕获

可通过burp插件、浏览器插件、代理服务器等方式向越权检测服务器传输流量

traffic文件中包含了burp插件和chrome扩展两个示例

  1. burp插件

    加载后,输入越权检测服务器的地址,在浏览器中打开任意页面登陆后,点击开始扫描即可

    burp

  2. chrome扩展

    加载后,输入越权检测服务器的地址,打开任意页面,登录即可

    pic

使用

登录

目前工具内置的两个账号,如下:(默认端口8888)

  • 管理员

    admin: admin123

  • 普通用户

    normal: normal123

正式使用时可接入自己公司内部的认证体系,以便标识使用者身份

examples中带了两个示例站点(默认端口8000、8001)和一个sso认证站点(默认端口 7373)

  • 管理员

    admin: admin123

  • 普通用户

    normal: normal123

在使用时,如果发现登陆了examples中的站点会导致越权检测工具的登陆状态失效,可考虑使用隐私窗口打开待测站点

预配置

工具支持两种类型系统的检测,sso认证和手动录入认证信息,sso认证以examples下的站点作为演示,如果要适配自己公司内部的sso,可修改相关认证逻辑

  • 录入账号

    先录入一些账号信息以便自动登陆sso,这里简单的录入账号密码作为演示(若要录入空账号,可将用户名设置为 - )

    账号录入

  • 工作空间

    在测试前,需要为待测站点创建一个工作空间,创建后根据要测试的系统来选择不同的认证逻辑。对于接入统一认证的系统,只需要输入首页url后点击解析按钮,并选择要使用的账号即可

    工作空间配置

    当然,自动认证的逻辑还是要自己实现,这里只是用examples中的站点做个示例

    对于一些不方便实现自动认证的系统,可以选择手动录入认证信息

    工作空间配置

越权漏洞检测

流程如下,burp插件/chrome扩展 会将流量实时发送至越权检测服务器中,测试人员可在流量明细界面实时监听

扫描的请求会对完全相同的请求进行去重,点击右上角的清空按钮后,可将工作空间内的流量清空,同时去重规则也会清空。如果需要再查看已被清空的流量的话,可选中左上角的“全量”按钮

测试中的可能存在问题的请求会高亮标识,选中左上角的”可疑“按钮,将会只查看可能存在的请求

上方的表单可以进行一定的筛选,筛选规则为 包含/不包含 ,若有多个,可以 | 进行分隔

每个请求包上都会有两个按钮,屏蔽和重放。点击屏蔽,可在上方的表单中添加对应的屏蔽规则,在重新查询或者监听时,不会再展示在屏蔽规则内的流量(只是不展示了,实际还存在的)。点击重放按钮,即可对该条请求进行重放,这在复测的时候比较好用

同时每次打开流量明细的窗口时,都会刷新对应工作空间的session信息(手动录入认证信息的工作空间不会刷新)

操作示意

run

开发指南

若系统没有接入统一认证或无法大批量实现自动认证,可直接部署好后,为每个工作空间手动录入认证信息

若可以实现待测系统的自动认证,可参考下面的内容来定制化工具

代码结构

authcheck/
├── app
│   ├── common
│   │   ├── decorators.py             # 装饰器
│   │   ├── func.py                   # 模板中用到的一些函数
│   │   ├── __init__.py
│   │   └── util.py                   # 辅助工具
│   ├── conf
│   │   ├── conf.py                   # 一些常规配置
│   │   ├── __init__.py
│   │   └── secret.py                 # 密钥、数据库等配置信息
│   ├── core
│   │   ├── flow.py                   # 站点解析
│   │   ├── identify                  # 不同系统类型的工作空间认证流程
│   │   │   ├── direct.py                 # 直接录入认证信息
│   │   │   ├── __init__.py
│   │   │   └── sso.py                    # 接入统一认证的系统(示例)
│   │   ├── __init__.py
│   │   ├── jobs.py                   # 定时任务
│   │   └── lib.py                    # 其他函数
│   ├── __init__.py
│   ├── model
│   │   ├── exception.py              # 异常类定义
│   │   ├── __init__.py
│   │   ├── model.py                  # 一些简单的model
│   │   └── po.py                     # 数据库model
│   ├── static
│   ├── templates
│   └── web
│       ├── api.py                    # 开放的api
│       ├── error.py                  # 异常处理
│       ├── __init__.py
│       ├── web.py                    # web页面
│       └── ws.py                     # 流量监听
├── docker-compose.yml
├── Dockerfile
├── favicon.ico
├── README.md
├── requirements.txt
├── uwsgi.ini
└── wsgi.py

主要改写流程

  • 确定自动认证的流程需要哪些信息,并在 app/model/po.py 中添加相应的模型

  • app/templates/ 下修改页面

  • app/lib/identify 下添加自己的认证流程,配置等

目前工具中放入了一个简单的自动认证sso的示例,可参考修改

Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

简介

越权检测工具 展开 收起
Apache-2.0
取消

发行版

暂无发行版

贡献者

全部

近期动态

加载更多
不能加载更多了
1
https://gitee.com/zto_express/secscan-authcheck.git
git@gitee.com:zto_express/secscan-authcheck.git
zto_express
secscan-authcheck
secscan-authcheck
master

搜索帮助