hellhound-spider 14.2__tar.gz → 14.3__tar.gz

{hellhound_spider-14.2 → hellhound_spider-14.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hellhound-spider
-Version: 14.2
+Version: 14.3
 Summary: Autonomous web crawler and recon engine for security testing — SPA + Non-SPA crawling, header analysis, subdomain enumeration, and intelligence classification
 Author-email: Sree Danush S <lazzer@gmail.com>
 License-Expression: GPL-3.0-or-later
@@ -46,11 +46,14 @@ Dynamic: license-file
 
 <p align="center">
   <img src="https://img.shields.io/badge/python-3.10+-blue?style=flat-square&logo=python&logoColor=white"/>
-  <img src="https://img.shields.io/badge/version-14.2-red?style=flat-square"/>
+  <img src="https://img.shields.io/badge/version-14.3-red?style=flat-square"/>
   <img src="https://img.shields.io/badge/pypi-hellhound--spider-blue?style=flat-square&logo=pypi&logoColor=white"/>
   <img src="https://img.shields.io/badge/platform-Linux%20%7C%20macOS%20%7C%20Windows-lightgrey?style=flat-square"/>
   <img src="https://img.shields.io/badge/license-GPL--3.0-blue?style=flat-square"/>
 </p>
+<p align="center">
+  <a href="https://devlist.app/listings/hellhound-spider"><img src="https://devlist.app/badges/listed-on-devlist-large.svg" alt="Listed on DevList" width="200"/></a>
+</p>
 
 ---
 
@@ -174,7 +177,12 @@ spider https://target.com --ctf-flag "HELLCORP{},FLAG{}"
 
 ### Discovery Vectors
 
-HTML crawl, live SPA XHR interception, parent-directory backtracking (probes ancestor directories the forward crawl never linked to), Intelligent Robots Analysis (Disallow/Allow mapping + comment mining), sitemap XML (with index recursion), `.well-known` (OIDC/JWKS), JSON path chaining, SPA hash routes, lazy-load attributes, CSP header hints, OpenAPI/Swagger specs, GraphQL introspection, crt.sh certificate transparency, Wayback Machine CDX API, security.txt (RFC 9116), HAR file import, HTML comment mining, response header analysis, TLS/DNS intel, WAF fingerprinting, and JS SCA analysis.
+HTML crawl, live SPA XHR interception, parent-directory backtracking (probes ancestor directories the forward crawl never linked to), Intelligent Robots Analysis (Disallow/Allow mapping + comment mining), sitemap XML (with index recursion), `.well-known` (OIDC/JWKS), JSON path chaining, SPA hash routes, lazy-load attributes, CSP header hints, OpenAPI/Swagger specs, GraphQL introspection, crt.sh certificate transparency, Wayback Machine CDX API, security.txt (RFC 9116), HAR file import, HTML comment mining, response header analysis, TLS/DNS intel, WAF fingerprinting, JS SCA analysis, OAuth/SSO redirect detection and provider fingerprinting (Okta, Azure AD, Google, Auth0, and more), and CAPTCHA detection.
+
+### Authentication
+
+- `-l/--login URL -n/--login-user USER -z/--login-pass PASS` — automates a classic HTML username/password login form and carries the session through the rest of the scan. Bails out with a report instead of guessing if the target turns out to be OAuth/SSO-gated or CAPTCHA-protected.
+- `-C/--cookie` — for everything `--login` can't handle (OAuth/SSO, MFA, anything scripted login isn't meant for): log in once by hand and hand Spider the session cookie.
 
 ### Parameter Mining
 

{hellhound_spider-14.2 → hellhound_spider-14.3}/README.md

@@ -10,11 +10,14 @@
 
 <p align="center">
   <img src="https://img.shields.io/badge/python-3.10+-blue?style=flat-square&logo=python&logoColor=white"/>
-  <img src="https://img.shields.io/badge/version-14.2-red?style=flat-square"/>
+  <img src="https://img.shields.io/badge/version-14.3-red?style=flat-square"/>
   <img src="https://img.shields.io/badge/pypi-hellhound--spider-blue?style=flat-square&logo=pypi&logoColor=white"/>
   <img src="https://img.shields.io/badge/platform-Linux%20%7C%20macOS%20%7C%20Windows-lightgrey?style=flat-square"/>
   <img src="https://img.shields.io/badge/license-GPL--3.0-blue?style=flat-square"/>
 </p>
+<p align="center">
+  <a href="https://devlist.app/listings/hellhound-spider"><img src="https://devlist.app/badges/listed-on-devlist-large.svg" alt="Listed on DevList" width="200"/></a>
+</p>
 
 ---
 
@@ -138,7 +141,12 @@ spider https://target.com --ctf-flag "HELLCORP{},FLAG{}"
 
 ### Discovery Vectors
 
-HTML crawl, live SPA XHR interception, parent-directory backtracking (probes ancestor directories the forward crawl never linked to), Intelligent Robots Analysis (Disallow/Allow mapping + comment mining), sitemap XML (with index recursion), `.well-known` (OIDC/JWKS), JSON path chaining, SPA hash routes, lazy-load attributes, CSP header hints, OpenAPI/Swagger specs, GraphQL introspection, crt.sh certificate transparency, Wayback Machine CDX API, security.txt (RFC 9116), HAR file import, HTML comment mining, response header analysis, TLS/DNS intel, WAF fingerprinting, and JS SCA analysis.
+HTML crawl, live SPA XHR interception, parent-directory backtracking (probes ancestor directories the forward crawl never linked to), Intelligent Robots Analysis (Disallow/Allow mapping + comment mining), sitemap XML (with index recursion), `.well-known` (OIDC/JWKS), JSON path chaining, SPA hash routes, lazy-load attributes, CSP header hints, OpenAPI/Swagger specs, GraphQL introspection, crt.sh certificate transparency, Wayback Machine CDX API, security.txt (RFC 9116), HAR file import, HTML comment mining, response header analysis, TLS/DNS intel, WAF fingerprinting, JS SCA analysis, OAuth/SSO redirect detection and provider fingerprinting (Okta, Azure AD, Google, Auth0, and more), and CAPTCHA detection.
+
+### Authentication
+
+- `-l/--login URL -n/--login-user USER -z/--login-pass PASS` — automates a classic HTML username/password login form and carries the session through the rest of the scan. Bails out with a report instead of guessing if the target turns out to be OAuth/SSO-gated or CAPTCHA-protected.
+- `-C/--cookie` — for everything `--login` can't handle (OAuth/SSO, MFA, anything scripted login isn't meant for): log in once by hand and hand Spider the session cookie.
 
 ### Parameter Mining
 

{hellhound_spider-14.2 → hellhound_spider-14.3}/hellhound_spider.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hellhound-spider
-Version: 14.2
+Version: 14.3
 Summary: Autonomous web crawler and recon engine for security testing — SPA + Non-SPA crawling, header analysis, subdomain enumeration, and intelligence classification
 Author-email: Sree Danush S <lazzer@gmail.com>
 License-Expression: GPL-3.0-or-later
@@ -46,11 +46,14 @@ Dynamic: license-file
 
 <p align="center">
   <img src="https://img.shields.io/badge/python-3.10+-blue?style=flat-square&logo=python&logoColor=white"/>
-  <img src="https://img.shields.io/badge/version-14.2-red?style=flat-square"/>
+  <img src="https://img.shields.io/badge/version-14.3-red?style=flat-square"/>
   <img src="https://img.shields.io/badge/pypi-hellhound--spider-blue?style=flat-square&logo=pypi&logoColor=white"/>
   <img src="https://img.shields.io/badge/platform-Linux%20%7C%20macOS%20%7C%20Windows-lightgrey?style=flat-square"/>
   <img src="https://img.shields.io/badge/license-GPL--3.0-blue?style=flat-square"/>
 </p>
+<p align="center">
+  <a href="https://devlist.app/listings/hellhound-spider"><img src="https://devlist.app/badges/listed-on-devlist-large.svg" alt="Listed on DevList" width="200"/></a>
+</p>
 
 ---
 
@@ -174,7 +177,12 @@ spider https://target.com --ctf-flag "HELLCORP{},FLAG{}"
 
 ### Discovery Vectors
 
-HTML crawl, live SPA XHR interception, parent-directory backtracking (probes ancestor directories the forward crawl never linked to), Intelligent Robots Analysis (Disallow/Allow mapping + comment mining), sitemap XML (with index recursion), `.well-known` (OIDC/JWKS), JSON path chaining, SPA hash routes, lazy-load attributes, CSP header hints, OpenAPI/Swagger specs, GraphQL introspection, crt.sh certificate transparency, Wayback Machine CDX API, security.txt (RFC 9116), HAR file import, HTML comment mining, response header analysis, TLS/DNS intel, WAF fingerprinting, and JS SCA analysis.
+HTML crawl, live SPA XHR interception, parent-directory backtracking (probes ancestor directories the forward crawl never linked to), Intelligent Robots Analysis (Disallow/Allow mapping + comment mining), sitemap XML (with index recursion), `.well-known` (OIDC/JWKS), JSON path chaining, SPA hash routes, lazy-load attributes, CSP header hints, OpenAPI/Swagger specs, GraphQL introspection, crt.sh certificate transparency, Wayback Machine CDX API, security.txt (RFC 9116), HAR file import, HTML comment mining, response header analysis, TLS/DNS intel, WAF fingerprinting, JS SCA analysis, OAuth/SSO redirect detection and provider fingerprinting (Okta, Azure AD, Google, Auth0, and more), and CAPTCHA detection.
+
+### Authentication
+
+- `-l/--login URL -n/--login-user USER -z/--login-pass PASS` — automates a classic HTML username/password login form and carries the session through the rest of the scan. Bails out with a report instead of guessing if the target turns out to be OAuth/SSO-gated or CAPTCHA-protected.
+- `-C/--cookie` — for everything `--login` can't handle (OAuth/SSO, MFA, anything scripted login isn't meant for): log in once by hand and hand Spider the session cookie.
 
 ### Parameter Mining
 

{hellhound_spider-14.2 → hellhound_spider-14.3}/man/spider.1

@@ -1,4 +1,4 @@
-.TH SPIDER 1 "2026-11-01" "Hellhound Spider v14.1" "User Commands"
+.TH SPIDER 1 "2026-11-06" "Hellhound Spider v14.3" "User Commands"
 .SH NAME
 spider \- SPA and non-SPA web crawler, endpoint discoverer, and attack-surface mapper
 .SH SYNOPSIS
@@ -82,9 +82,9 @@ Show all discovery logs, including low-confidence and informational events.
 .TP
 .BR \-C ", " \-\-cookie " " \fICOOKIE\fR
 Cookie string (e.g. \fB"session=42"\fR), dict-style string, or path to a cookie
-file. Used to scan authenticated areas of the application. Since the spider does
-not support automated form-login using username and password, you must manually
-log in via a browser and supply the session cookie here.
+file. Used to scan authenticated areas of the application. For an OAuth/SSO-gated
+target, or any login flow \fB\-\-login\fR can't handle, log in manually via a
+browser and supply the resulting session cookie here instead.
 .TP
 .BR \-a ", " \-\-auth " " \fIHEADER\fR
 Authorization header value, e.g. \fB"Bearer eyJ..."\fR.
@@ -96,6 +96,20 @@ this is for server-level basic authentication, not standard web login forms.
 .BR \-X ", " \-\-header " " \fI"NAME: VALUE"\fR
 Custom HTTP header, repeatable. Pass custom headers formatted as \fB"Name: Value"\fR.
 Useful for program-required tester identification or custom tokens.
+.TP
+.BR \-l ", " \-\-login " " \fIURL\fR
+URL of a classic HTML username/password login form. Spider parses the form,
+submits \fB\-n\fR/\fB\-z\fR (\fB\-\-login\-user\fR/\fB\-\-login\-pass\fR), and
+carries the resulting session cookies through the rest of the scan. Aborts
+with a clear report (no submission attempted) if the page redirects to a
+third-party OAuth/SSO provider or serves a CAPTCHA \(em neither is something
+Spider will try to bypass; use \fB\-\-cookie\fR instead for those.
+.TP
+.BR \-n ", " \-\-login\-user " " \fIUSERNAME\fR
+Username/email to submit with \fB\-l\fR/\fB\-\-login\fR.
+.TP
+.BR \-z ", " \-\-login\-pass " " \fIPASSWORD\fR
+Password to submit with \fB\-l\fR/\fB\-\-login\fR.
 .SS "Output"
 .TP
 .BR \-o ", " \-\-out " " \fIFILE\fR

{hellhound_spider-14.2 → hellhound_spider-14.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "hellhound-spider"
-version = "14.2"
+version = "14.3"
 description = "Autonomous web crawler and recon engine for security testing — SPA + Non-SPA crawling, header analysis, subdomain enumeration, and intelligence classification"
 readme = "README.md"
 requires-python = ">=3.10"

{hellhound_spider-14.2 → hellhound_spider-14.3}/spider.py

@@ -61,7 +61,7 @@ except Exception:
           
                                                                         
 
-VERSION      = "14.2"
+VERSION      = "14.3"
 __author__   = "Sree Danush S (L4ZZ3RJ0D)"
 __license__  = "GPLv3"
 __credits__  = ["L4ZZ3RJ0D"]
@@ -837,7 +837,68 @@ def print_results(intel: dict, target: str, elapsed: float,
                 pill = f"{sev_col}{C.B} {sev} {C.RST}"
                 print(f"  {pill}  {C.W}{f.get('issue','')}{C.RST}  {C.GR}{f.get('detail','')}{C.RST}")
 
-                                                                        
+
+    # ── AUTH / OAUTH / SSO / CAPTCHA / LOGIN — "summary is what most
+    # hackers actually read" per explicit design intent, so all of this
+    # surfaces here, not just in the live feed. ────────────────────────
+    login_result    = intel.get("login_result")
+    oauth_findings  = intel.get("oauth_findings", [])
+    captcha_findings = intel.get("captcha_findings", [])
+
+    if login_result is not None:
+        ok = login_result.get("ok")
+        emit.section("LOGIN AUTOMATION", orbital=True)
+        if nc:
+            print(f"  [{'OK' if ok else 'FAILED'}] " + (
+                f"Authenticated — cookies set: {', '.join(login_result.get('cookies_set', []))}"
+                if ok else f"Not authenticated — {login_result.get('reason','unknown reason')}"))
+        else:
+            if ok:
+                print(f"  {C.G}●{C.RST} {C.G}Authenticated{C.RST}  "
+                      f"{C.W}cookies set: {', '.join(login_result.get('cookies_set', []))}{C.RST}")
+            else:
+                print(f"  {C.R}●{C.RST} {C.R}Not authenticated{C.RST}  "
+                      f"{C.GR}{login_result.get('reason','unknown reason')}{C.RST}")
+
+    if oauth_findings:
+        emit.section(f"OAUTH / SSO DETECTION  ({len(oauth_findings)} redirect(s) fingerprinted)", orbital=True)
+        if not nc:
+            emit.row("Note", "Detected during unauthenticated recon — fingerprinting only, "
+                              "Spider never follows or automates the OAuth flow itself",
+                     icon="○", label_colour=C.CY, value_colour=C.W)
+        for f in sorted(oauth_findings, key=lambda f: f.get("provider","")):
+            provider = f.get("provider","Unknown")
+            trig     = f.get("trigger_url","")
+            authz    = f.get("authorize_url","")
+            params   = f.get("params", {})
+            gaps = []
+            if not f.get("has_pkce"):  gaps.append("no PKCE")
+            if not f.get("has_state"): gaps.append("no state param")
+            gap_str = f"  [{', '.join(gaps)}]" if gaps else ""
+            if nc:
+                print(f"  ● {provider:<28} {trig}  ->  {authz}{gap_str}")
+                if params:
+                    print(f"       params: {params}")
+            else:
+                gap_col = C.R if gaps else C.G
+                print(f"  {C.MG}●{C.RST} {C.W}{provider:<28}{C.RST} {C.CYD}{trig}{C.RST}")
+                print(f"  {C.GR}     └─ authorize:{C.RST} {C.Y}{authz}{C.RST}{f'  {gap_col}{gap_str}{C.RST}' if gap_str else ''}")
+                if params:
+                    pstr = ", ".join(f"{k}={v}" for k, v in params.items())
+                    print(f"  {C.GR}        params: {pstr}{C.RST}")
+
+    if captcha_findings:
+        emit.section(f"CAPTCHA DETECTION  ({len(captcha_findings)} found)", orbital=True)
+        if not nc:
+            emit.row("Note", "Detect-and-report only — Spider never attempts to solve a CAPTCHA",
+                     icon="○", label_colour=C.CY, value_colour=C.W)
+        for f in sorted(captcha_findings, key=lambda f: f.get("url","")):
+            if nc:
+                print(f"  ● {f.get('type',''):<28} {f.get('url','')}")
+            else:
+                print(f"  {C.Y}●{C.RST} {C.W}{f.get('type',''):<28}{C.RST} {C.CYD}{f.get('url','')}{C.RST}")
+
+
     crt_subs = intel.get("crt_subdomains", [])
     if crt_subs:
         emit.section(f"CRT.SH SUBDOMAINS  ({len(crt_subs)} discovered)", orbital=True)
@@ -1699,6 +1760,13 @@ class Config:
         # default; disable with --no-backtrack.
         self.enable_backtrack   = kw.get("enable_backtrack",   True)
         self.ctf_flag_templates = kw.get("ctf_flag_templates", [])
+        # Classic HTML username/password form-login automation. Off unless
+        # --login is given. OAuth/SSO redirect detection and CAPTCHA
+        # detection run as part of it, and also run independently during
+        # ordinary unauthenticated recon regardless of this flag.
+        self.login_url  = kw.get("login_url",  None)
+        self.login_user = kw.get("login_user", None)
+        self.login_pass = kw.get("login_pass", None)
                                                                 
         self.extra_scope: frozenset = frozenset(kw.get("extra_scope", []))
         self.user_agent = kw.get(
@@ -1714,6 +1782,10 @@ class Config:
             raise ValueError("concurrency must be 1–100")
         if self.max_runtime is not None and self.max_runtime < 0:
             raise ValueError("max_runtime must be >= 0 (0 disables the cap)")
+        if self.login_url and not (self.login_user and self.login_pass):
+            raise ValueError("--login requires both --login-user and --login-pass")
+        if (self.login_user or self.login_pass) and not self.login_url:
+            raise ValueError("--login-user/--login-pass require --login <url>")
 
                                                                         
                           
@@ -1903,9 +1975,120 @@ async def fetch_with_redirect(session, method, url, rl, max_retries=3, base_dela
                 await asyncio.sleep(base_delay * (2**attempt))
     return None, None, None, url
 
-                                                                        
-               
-                                                                        
+
+async def fetch_no_redirect(session, method, url, rl, max_retries=2, base_delay=0.5, **kw):
+    """Like fetch(), but never follows redirects — returns the raw Location
+    header too. Used for OAuth/SSO redirect fingerprinting, where the whole
+    point is to see where the target *would* have sent the browser, not to
+    follow it there."""
+    domain = urlparse(url).netloc
+    await rl.wait(domain)
+    for attempt in range(max_retries + 1):
+        try:
+            async with session.request(method, url, ssl=False,
+                                       allow_redirects=False, **kw) as resp:
+                if resp.status == 429:
+                    rl.backoff(domain)
+                    await asyncio.sleep(float(resp.headers.get("Retry-After", base_delay * (2**attempt))))
+                    continue
+                body = ""
+                try:
+                    body = await resp.text(errors="replace")
+                except Exception:
+                    body = ""
+                rl.recover(domain)
+                return resp.status, dict(resp.headers), body, resp.headers.get("Location", "")
+        except Exception:
+            if attempt < max_retries:
+                await asyncio.sleep(base_delay * (2**attempt))
+    return None, None, "", ""
+
+
+# ── CAPTCHA detection (detect-and-report only — Spider never attempts to
+# solve or bypass a CAPTCHA) ─────────────────────────────────────────────
+_CAPTCHA_SIGNATURES = (
+    (re.compile(r'g-recaptcha|recaptcha/api\.js|grecaptcha\.render|www\.google\.com/recaptcha', re.I), "reCAPTCHA (Google)"),
+    (re.compile(r'h-captcha|hcaptcha\.com/1/api\.js', re.I), "hCaptcha"),
+    (re.compile(r'cf-turnstile|challenges\.cloudflare\.com/turnstile', re.I), "Cloudflare Turnstile"),
+    (re.compile(r'arkoselabs|funcaptcha|fc-token', re.I), "Arkose Labs / FunCaptcha"),
+    (re.compile(r'captcha', re.I), "Generic/Unidentified CAPTCHA"),
+)
+
+def detect_captcha(body: Optional[str]) -> Optional[str]:
+    """Return a human-readable CAPTCHA provider name if the response body
+    carries a recognizable CAPTCHA widget marker, else None. Detection only."""
+    if not body:
+        return None
+    for pattern, name in _CAPTCHA_SIGNATURES:
+        if pattern.search(body):
+            return name
+    return None
+
+
+# ── OAuth / SSO redirect fingerprinting (detect-and-report only — Spider
+# never attempts to automate or bypass the actual OAuth/OIDC flow) ───────
+_OAUTH_LOGIN_TRIGGER_PATHS = (
+    "/login", "/signin", "/sign-in", "/log-in", "/account/login",
+    "/user/login", "/auth", "/auth/login", "/authorize", "/authenticate",
+    "/sso", "/sso/login", "/oauth", "/oauth2", "/connect/authorize",
+    "/dashboard", "/account", "/admin",
+)
+
+_OAUTH_PROVIDER_SIGS = (
+    (re.compile(r'\.okta\.com|\.oktapreview\.com|\.okta-emea\.com', re.I), "Okta"),
+    (re.compile(r'login\.microsoftonline\.com|\.b2clogin\.com|login\.windows\.net|login\.live\.com', re.I), "Microsoft Entra ID / Azure AD"),
+    (re.compile(r'accounts\.google\.com', re.I), "Google"),
+    (re.compile(r'\.auth0\.com', re.I), "Auth0"),
+    (re.compile(r'\.onelogin\.com', re.I), "OneLogin"),
+    (re.compile(r'\.pingone\.com|\.pingidentity\.com', re.I), "Ping Identity"),
+    (re.compile(r'cognito-idp\.[\w-]+\.amazonaws\.com|\.auth\.[\w-]+\.amazoncognito\.com', re.I), "AWS Cognito"),
+    (re.compile(r'/realms/[^/]+/protocol/openid-connect', re.I), "Keycloak"),
+    (re.compile(r'github\.com/login/oauth', re.I), "GitHub OAuth"),
+    (re.compile(r'(?:www\.)?facebook\.com/.*dialog/oauth', re.I), "Facebook OAuth"),
+    (re.compile(r'appleid\.apple\.com', re.I), "Sign in with Apple"),
+    (re.compile(r'\.frontegg\.com', re.I), "Frontegg"),
+)
+
+# Shape of an OAuth2/OIDC authorization request — a query string carrying
+# client_id/response_type, or a path that looks like an /authorize endpoint.
+_OAUTH_QS_SHAPE_RE   = re.compile(r'[?&](client_id|response_type)=', re.I)
+_OAUTH_PATH_SHAPE_RE = re.compile(r'/(?:oauth2?/)?(?:authorize|auth)(?:[/?]|$)|/connect/authorize|/protocol/openid-connect/auth', re.I)
+
+_OAUTH_PARAM_KEYS = (
+    "client_id", "redirect_uri", "response_type", "scope", "state",
+    "code_challenge", "code_challenge_method", "nonce", "response_mode",
+)
+
+def classify_oauth_redirect(location: str) -> Optional[dict]:
+    """Given an absolute URL a target redirected to, decide whether it looks
+    like a third-party OAuth2/OIDC authorization request and, if so, which
+    provider it is. Returns None for anything that doesn't look OAuth-shaped
+    (e.g. a plain same-site redirect to another page). This is pure
+    fingerprinting — it never follows the URL or attempts the flow."""
+    if not location:
+        return None
+    looks_oauth = bool(_OAUTH_QS_SHAPE_RE.search(location)) or bool(_OAUTH_PATH_SHAPE_RE.search(location))
+    if not looks_oauth:
+        return None
+    provider = "Generic OAuth2/OIDC"
+    for pattern, name in _OAUTH_PROVIDER_SIGS:
+        if pattern.search(location):
+            provider = name
+            break
+    parsed = urlparse(location)
+    qs = parse_qs(parsed.query)
+    params = {k: qs[k][0] for k in _OAUTH_PARAM_KEYS if k in qs}
+    return {
+        "provider":      provider,
+        "authorize_url": location,
+        "params":        params,
+        "has_pkce":      "code_challenge" in params,
+        "has_state":     "state" in params,
+    }
+
+
+
+
 
 _ID_RE = re.compile(
     r'^(?:\d{1,20}'
@@ -2165,6 +2348,15 @@ class Store:
         self.cloud_probes:       List[dict] = []
         self.page_bg_requests:   Dict[str, List[dict]] = defaultdict(list)
         self._bg_req_seen:       Set[tuple] = set()
+        # OAuth/SSO redirect fingerprints found during unauthenticated recon,
+        # CAPTCHA widget markers found on any probed page, and the outcome
+        # (if any) of --login form-login automation. All detect/report —
+        # nothing here is ever acted on automatically.
+        self.oauth_findings:  List[dict] = []
+        self._oauth_seen:     Set[str]   = set()
+        self.captcha_findings: List[dict] = []
+        self._captcha_seen:    Set[str]   = set()
+        self.login_result:    Optional[dict] = None
 
     def record_bg_request(self, page_url: str, bg_url: str, method: str = "GET", source: str = "DeepSPA"):
         if not page_url or not bg_url:
@@ -2853,6 +3045,9 @@ class Store:
             "js_libs":           self.js_libs,
             "cloud_probes":      self.cloud_probes,
             "spa_background_requests": dict(self.page_bg_requests),
+            "oauth_findings":    self.oauth_findings,
+            "captcha_findings":  self.captcha_findings,
+            "login_result":      self.login_result,
 
                                                                              
                                                                                
@@ -8572,6 +8767,211 @@ class Spider:
                                         auth_required=True)
                 self.emit.always_success(f"[OIDC] {key}: {ep_url}")
 
+    async def _record_oauth_finding(self, trigger_url: str, info: dict):
+        if info["authorize_url"] in self.store._oauth_seen:
+            return
+        self.store.oauth_findings.append({"trigger_url": trigger_url, **info})
+        self.store._oauth_seen.add(info["authorize_url"])
+        self.emit.crawl_feed("OAuth/SSO", "GET", Emit.trunc_url(info["authorize_url"]))
+        self.emit.always_success(f"[OAuth] {info['provider']} detected  ←  {Emit.trunc_url(trigger_url, 50)}")
+        gaps = []
+        if not info["has_pkce"]:
+            gaps.append("no PKCE (code_challenge)")
+        if not info["has_state"]:
+            gaps.append("no state param (possible CSRF on the OAuth callback)")
+        if gaps:
+            self.emit.always_info(f"[OAuth] {info['provider']} authorize request missing: {', '.join(gaps)}")
+
+    def _record_captcha_finding(self, url: str, kind: str):
+        if url in self.store._captcha_seen:
+            return
+        self.store._captcha_seen.add(url)
+        self.store.captcha_findings.append({"url": url, "type": kind})
+        self.emit.always_info(f"[CAPTCHA] {kind} detected at {Emit.trunc_url(url, 55)}")
+
+    async def _detect_oauth_sso(self, session):
+        """Unauthenticated-recon OAuth/SSO fingerprinting. Probes a short list
+        of common login-trigger paths with redirects disabled so the raw
+        Location header (if any) can be inspected, classifies anything
+        OAuth/OIDC-authorize-shaped, and identifies the provider by hostname/
+        path pattern. Also checks whatever body comes back for CAPTCHA
+        markers. Detection and fingerprinting only — Spider never attempts
+        to follow or automate the actual OAuth flow, and never attempts to
+        solve a CAPTCHA. Runs during every unauthenticated recon pass,
+        independent of --login."""
+        for path in _OAUTH_LOGIN_TRIGGER_PATHS:
+            url = urljoin(self.target, path)
+            try:
+                status, headers, body, loc = await fetch_no_redirect(session, "GET", url, self.rl)
+            except Exception:
+                continue
+            if status is None:
+                continue
+
+            if loc:
+                abs_loc = urljoin(url, loc)
+                info = classify_oauth_redirect(abs_loc)
+                if info:
+                    await self._record_oauth_finding(url, info)
+
+            cap = detect_captcha(body)
+            if cap:
+                self._record_captcha_finding(url, cap)
+
+    async def _attempt_login(self, session):
+        """Classic HTML username/password form-login automation, gated
+        behind --login/--login-user/--login-pass. Parses the login form,
+        pre-checks the page for an OAuth/SSO redirect or a CAPTCHA and
+        aborts (reporting, not attempting) if either is found — those are
+        both explicitly out of scope for automation — then submits the
+        form and merges any resulting session cookies into the active
+        aiohttp session so the rest of the scan runs authenticated."""
+        login_url = self.cfg.login_url
+        self.emit.animator.update(0, "Recon Login")
+        self.emit.always_info(f"[Login] Attempting form login at {login_url}")
+
+        status, headers, body, loc = await fetch_no_redirect(session, "GET", login_url, self.rl)
+        if status is None:
+            self.store.login_result = {"ok": False, "reason": "login page unreachable"}
+            self.emit.warn(f"[Login] {login_url} unreachable — skipping login automation")
+            return
+
+        # Target already redirected before we even saw a form — almost
+        # certainly SSO, not a page we can submit credentials to.
+        if loc:
+            abs_loc = urljoin(login_url, loc)
+            info = classify_oauth_redirect(abs_loc)
+            if info:
+                await self._record_oauth_finding(login_url, info)
+                self.store.login_result = {
+                    "ok": False,
+                    "reason": f"login URL redirects to {info['provider']} (OAuth/SSO) — "
+                              f"automated form submission isn't applicable here",
+                }
+                self.emit.warn(f"[Login] Aborted — {login_url} redirects to an OAuth/SSO "
+                                f"provider ({info['provider']}). Use --cookie with a "
+                                f"manually-obtained session instead.")
+                return
+            # Non-OAuth redirect (e.g. http->https, or a login page that
+            # lives at a different path) — follow it once to find the form.
+            status, headers, body, _ = await fetch(session, "GET", abs_loc, self.rl)
+            login_url = abs_loc
+            if status is None:
+                self.store.login_result = {"ok": False, "reason": "login page unreachable after redirect"}
+                return
+
+        cap = detect_captcha(body)
+        if cap:
+            self._record_captcha_finding(login_url, cap)
+            self.store.login_result = {"ok": False, "reason": f"{cap} present on login page"}
+            self.emit.warn(f"[Login] Aborted — {cap} detected on {login_url}. "
+                            f"Spider detects and reports CAPTCHAs; it never attempts to solve them.")
+            return
+
+        soup = BeautifulSoup(body or "", "lxml")
+        login_form = None
+        for form in soup.find_all("form"):
+            if form.find("input", attrs={"type": re.compile("^password$", re.I)}):
+                login_form = form
+                break
+        if login_form is None:
+            self.store.login_result = {"ok": False, "reason": "no username/password form found on the page"}
+            self.emit.warn(f"[Login] Aborted — no login form (password field) found at {login_url}")
+            return
+
+        action = login_form.get("action") or login_url
+        post_url = urljoin(login_url, action)
+        method = (login_form.get("method") or "POST").upper()
+
+        payload = {}
+        user_field = pass_field = None
+        for el in login_form.find_all(["input", "select", "textarea"]):
+            nm = (el.get("name") or "").strip()
+            if not nm:
+                continue
+            el_type = (el.get("type") or "text").lower()
+            if el_type == "password":
+                pass_field = nm
+                continue
+            if el_type in ("submit", "button", "reset", "image", "file"):
+                continue
+            if el_type == "hidden":
+                payload[nm] = el.get("value", "")
+                continue
+            # Likely the username/email field — first non-hidden text-ish
+            # input that isn't the password field itself.
+            name_id_blob = f"{nm} {el.get('id','')} {el.get('placeholder','')}".lower()
+            if user_field is None and (
+                el_type in ("text", "email") or
+                re.search(r'user|email|login|account', name_id_blob)
+            ):
+                user_field = nm
+            else:
+                payload.setdefault(nm, el.get("value", ""))
+
+        if not pass_field:
+            self.store.login_result = {"ok": False, "reason": "form has no password field"}
+            self.emit.warn(f"[Login] Aborted — couldn't identify a password field in the form at {login_url}")
+            return
+        if not user_field:
+            # Fall back to the first non-password, non-hidden input.
+            for el in login_form.find_all(["input"]):
+                nm = (el.get("name") or "").strip()
+                el_type = (el.get("type") or "text").lower()
+                if nm and nm != pass_field and el_type not in ("hidden", "submit", "button", "reset", "image", "file"):
+                    user_field = nm
+                    break
+        if not user_field:
+            self.store.login_result = {"ok": False, "reason": "couldn't identify a username/email field"}
+            self.emit.warn(f"[Login] Aborted — couldn't identify a username field in the form at {login_url}")
+            return
+
+        payload[user_field] = self.cfg.login_user
+        payload[pass_field]  = self.cfg.login_pass
+
+        pre_login_cookies = {c.key: c.value for c in session.cookie_jar}
+        try:
+            async with session.request(method, post_url, data=payload, ssl=False,
+                                       allow_redirects=True,
+                                       timeout=aiohttp.ClientTimeout(total=self.cfg.timeout)) as resp:
+                resp_status = resp.status
+                resp_text   = await resp.text(errors="replace")
+                final_url   = str(resp.url)
+        except Exception as e:
+            self.store.login_result = {"ok": False, "reason": f"submission failed: {e}"}
+            self.emit.warn(f"[Login] Submission to {post_url} failed: {e}")
+            return
+
+        post_login_cookies = {c.key: c.value for c in session.cookie_jar}
+        new_cookies = {k: v for k, v in post_login_cookies.items() if pre_login_cookies.get(k) != v}
+
+        # Heuristic success check: got new cookies beyond what we started
+        # with, and nothing on the response page still smells like a fresh
+        # login form (password field) or an explicit error marker.
+        still_has_password_field = bool(re.search(
+            r'type=["\']?password', resp_text or "", re.I))
+        looks_like_error = bool(re.search(
+            r'invalid (?:username|password|login|credentials)|login failed|incorrect password',
+            resp_text or "", re.I))
+        success = bool(new_cookies) and not still_has_password_field and not looks_like_error
+
+        if success:
+            self.cookies.update(new_cookies)
+            self.store.login_result = {
+                "ok": True, "post_url": post_url, "final_url": final_url,
+                "cookies_set": sorted(new_cookies.keys()),
+            }
+            self.emit.always_success(
+                f"[Login] Success — {len(new_cookies)} session cookie(s) set, "
+                f"continuing the scan authenticated")
+        else:
+            reason = "server returned a login error" if looks_like_error else \
+                     "no new session cookie after submission" if not new_cookies else \
+                     "response still looks like the login page"
+            self.store.login_result = {"ok": False, "reason": reason, "status": resp_status, "final_url": final_url}
+            self.emit.warn(f"[Login] Submission to {post_url} didn't look successful ({reason}) — "
+                            f"continuing the scan unauthenticated")
+
     _AUTOINDEX_SIGS = re.compile(
         r'index of /|<title>\s*index of|parent directory</a>|\[to parent directory\]|'
         r'directory listing for',
@@ -8735,8 +9135,14 @@ class Spider:
         req_headers.update(self.extra_headers)
         connector = aiohttp.TCPConnector(limit=self.cfg.concurrency, ttl_dns_cache=300, ssl=False)
         timeout   = aiohttp.ClientTimeout(total=self.cfg.timeout)
+        # unsafe=True: aiohttp's default cookie jar silently refuses to store
+        # cookies for plain IP-address hosts, which breaks session-cookie
+        # handling (including --login) against bare-IP and internal targets —
+        # a routine case in pentesting.
+        cookie_jar = aiohttp.CookieJar(unsafe=True)
         async with aiohttp.ClientSession(headers=req_headers, cookies=self.cookies,
-                                          timeout=timeout, connector=connector) as session:
+                                          timeout=timeout, connector=connector,
+                                          cookie_jar=cookie_jar) as session:
             try:
                                                                         
                 _t_phase_start = time.time()
@@ -8773,6 +9179,27 @@ class Spider:
 
                 self.emit.animator.start_anim("Recon Probing Base")
 
+                # ── Auth surface: optional form-login automation, then
+                # OAuth/SSO redirect fingerprinting + CAPTCHA detection ──
+                # Login runs first (when requested) so its cookies are
+                # merged into the session before anything else. The OAuth/
+                # SSO probe runs unconditionally afterward — on a target
+                # that redirects to third-party SSO, the unauthenticated
+                # case is exactly when these login-trigger paths bounce
+                # somewhere interesting; a successfully authenticated scan
+                # simply won't see those redirects, so this is safe either way.
+                if self.cfg.login_url:
+                    try:
+                        await self._attempt_login(session)
+                    except Exception as e:
+                        self.store.login_result = {"ok": False, "reason": f"unexpected error: {e}"}
+                        self.emit.warn(f"[Login] Unexpected error during login automation: {e}")
+                self.emit.animator.update(0, "Recon Auth / SSO Surface")
+                try:
+                    await self._detect_oauth_sso(session)
+                except Exception as e:
+                    self.emit.warn(f"[OAuth] Detection pass failed: {e}")
+
                 # ── Fire WhatWeb + TLS concurrently ───────────────────────────
                 async def _tls_and_headers():
                     if not getattr(self.cfg, 'no_tls', False):
@@ -9363,8 +9790,8 @@ def _build_parser() -> argparse.ArgumentParser:
     auth = p.add_argument_group(f"{C.CY}Authentication{C.RST}")
     auth.add_argument("--cookie",  "-C", type=str, default=None, metavar="COOKIE",
                       help='Cookie string (e.g., "session=42"), dict, or path to a cookie file. '
-                           'Since the spider does not support automated form-login using username/password, '
-                           'you must manually log in via a browser and supply the session cookie here.')
+                           'For an OAuth/SSO-gated target, or any login flow --login can\'t handle, '
+                           'log in manually via a browser and supply the resulting session cookie here instead.')
     auth.add_argument("--auth",    "-a", type=str, default=None, metavar="HEADER",
                       help='Authorization header  e.g. "Bearer eyJ..."')
     auth.add_argument("--basic-auth", "-u", type=str, default=None, metavar="USER:PASS",
@@ -9374,6 +9801,17 @@ def _build_parser() -> argparse.ArgumentParser:
                       help='Custom header, repeatable, formatted as "Name: Value"  e.g. -X "X-Bug-Bounty: Bugcrowd-yourhandle" '
                            '-X "X-Research-Purpose: authorized-pentest"  '
                            '(use for program-required tester-identification headers)')
+    auth.add_argument("--login", "-l", type=str, default=None, metavar="URL",
+                      help='URL of a classic HTML username/password login form. Spider parses the '
+                           'form, submits -n/-z (--login-user/--login-pass), and carries the resulting '
+                           'session cookies through the rest of the scan. Aborts with a clear report '
+                           '(no submission attempted) if the page redirects to a third-party OAuth/SSO '
+                           'provider or serves a CAPTCHA — neither is something Spider will try to bypass; '
+                           'use --cookie instead for those.')
+    auth.add_argument("--login-user", "-n", type=str, default=None, metavar="USERNAME",
+                      help='Username/email to submit with -l/--login')
+    auth.add_argument("--login-pass", "-z", type=str, default=None, metavar="PASSWORD",
+                      help='Password to submit with -l/--login')
 
     out = p.add_argument_group(f"{C.CY}Output{C.RST}")
     out.add_argument("--out",    "-o", type=str, default=None, metavar="FILE",
@@ -9683,6 +10121,9 @@ def main():
                                  if args.ctf_flag else [],
             extra_scope       = [h.strip() for h in args.scope.split(",") if h.strip()]
                                 if args.scope else [],
+            login_url         = args.login,
+            login_user        = args.login_user,
+            login_pass        = args.login_pass,
         )
 
         print()