stryx-cli 0.1.0__py3-none-any.whl

stryx/scanners/auth.py

@@ -0,0 +1,444 @@
+"""Authentication vulnerability scanner.
+
+Tests: missing authentication, weak JWT validation, expired JWT acceptance,
+unsigned JWTs, session fixation, cookie security, OAuth/provider misconfiguration.
+Detects: JWT, OAuth2, Clerk, Supabase, Firebase, Auth0, Better Auth, session cookies.
+"""
+
+from __future__ import annotations
+
+import base64
+import json
+import re
+import time
+
+from stryx.utils.evidence import Finding, Severity
+from stryx.utils.http_client import HttpClient
+from stryx.utils.logging import get_logger
+
+logger = get_logger("scanner.auth")
+
+
+# --- Provider fingerprinting ---
+
+PROVIDER_FINGERPRINTS = {
+    "jwt": {
+        "headers": ["authorization"],
+        "header_patterns": [r"Bearer\s+eyJ"],
+        "cookie_patterns": [r"token=", r"jwt=", r"access_token="],
+        "response_patterns": [r"jwt", r"bearer", r"token"],
+    },
+    "oauth2": {
+        "headers": ["x-oauth-token", "x-auth-token"],
+        "header_patterns": [r"Bearer"],
+        "cookie_patterns": [r"oauth", r"_oauth2", r"gsession"],
+        "response_patterns": [r"oauth", r"authorize", r"redirect_uri"],
+    },
+    "clerk": {
+        "headers": ["x-clerk-auth-status", "x-clerk-user-id"],
+        "header_patterns": [],
+        "cookie_patterns": [r"__session", r"__client"],
+        "response_patterns": [r"clerk", r"clerk\.publishable"],
+    },
+    "supabase": {
+        "headers": ["x-supabase-auth"],
+        "header_patterns": [r"supabase"],
+        "cookie_patterns": [r"sb-", r"supabase"],
+        "response_patterns": [r"supabase", r"supabase\.co"],
+    },
+    "firebase": {
+        "headers": ["x-firebase-auth"],
+        "header_patterns": [],
+        "cookie_patterns": [r"__session", r"firebase"],
+        "response_patterns": [r"firebase", r"firebaseio\.com", r"firebaseapp"],
+    },
+    "auth0": {
+        "headers": ["x-auth0-request-id"],
+        "header_patterns": [r"auth0"],
+        "cookie_patterns": [r"auth0", r"_auth0"],
+        "response_patterns": [r"auth0\.", r"auth0\.com"],
+    },
+    "better_auth": {
+        "headers": ["x-better-auth"],
+        "header_patterns": [r"better-auth"],
+        "cookie_patterns": [r"better-auth", r"ba_"],
+        "response_patterns": [r"better-auth", r"better\.auth"],
+    },
+    "session_cookie": {
+        "headers": [],
+        "header_patterns": [],
+        "cookie_patterns": [
+            r"session", r"sid", r"connect\.sid", r"JSESSIONID",
+            r"_session_id", r"laravel_session", r"csrftoken",
+        ],
+        "response_patterns": [],
+    },
+}
+
+
+def detect_auth_providers(
+    response_headers: dict[str, str],
+    response_cookies: dict[str, str],
+    response_body: str = "",
+) -> list[str]:
+    """Detect authentication providers from response headers, cookies, and body.
+
+    Returns list of detected provider names.
+    """
+    detected = []
+    header_str = json.dumps(response_headers).lower()
+    cookie_str = json.dumps(response_cookies).lower()
+    body_lower = response_body.lower()
+
+    for provider, fp in PROVIDER_FINGERPRINTS.items():
+        found = False
+
+        # Check response headers
+        for h in fp["headers"]:
+            if h in header_str:
+                found = True
+                break
+
+        # Check header patterns
+        for pattern in fp["header_patterns"]:
+            if re.search(pattern, header_str, re.IGNORECASE):
+                found = True
+                break
+
+        # Check cookie patterns
+        for pattern in fp["cookie_patterns"]:
+            if re.search(pattern, cookie_str, re.IGNORECASE):
+                found = True
+                break
+
+        # Check response body patterns
+        for pattern in fp["response_patterns"]:
+            if re.search(pattern, body_lower, re.IGNORECASE):
+                found = True
+                break
+
+        if found:
+            detected.append(provider)
+
+    return detected
+
+
+class AuthScanner:
+    """Scanner for authentication vulnerabilities."""
+
+    def __init__(self, client: HttpClient):
+        self.client = client
+        self.detected_providers: list[str] = []
+
+    async def scan(
+        self, endpoints: list[str], base_url: str
+    ) -> list[Finding]:
+        """Run authentication tests against the target."""
+        findings: list[Finding] = []
+        logger.info("Running authentication scanner")
+
+        # Stage 1: Fingerprint providers from a real response
+        await self._fingerprint_providers(base_url)
+
+        # Stage 2: Test unauthenticated access to protected endpoints
+        findings.extend(await self._test_missing_auth(endpoints, base_url))
+
+        # Stage 3: Test JWT weaknesses based on detected provider
+        findings.extend(await self._test_jwt_weaknesses(endpoints, base_url))
+
+        # Stage 4: Test session fixation
+        findings.extend(await self._test_session_fixation(base_url))
+
+        # Stage 5: Test cookie security
+        findings.extend(await self._test_cookie_security(base_url))
+
+        logger.info(f"Auth scanner found {len(findings)} findings")
+        return findings
+
+    async def _fingerprint_providers(self, base_url: str) -> None:
+        """Fingerprint authentication providers from the target."""
+        try:
+            response, evidence = await self.client.get(base_url)
+            self.detected_providers = detect_auth_providers(
+                dict(response.headers),
+                dict(response.cookies),
+                response.text,
+            )
+            if self.detected_providers:
+                logger.info(
+                    f"Detected auth providers: {', '.join(self.detected_providers)}"
+                )
+        except Exception as e:
+            logger.debug(f"Provider fingerprinting failed: {e}")
+
+    async def _test_missing_auth(
+        self, endpoints: list[str], base_url: str
+    ) -> list[Finding]:
+        """Test if endpoints are accessible without authentication."""
+        findings: list[Finding] = []
+
+        protected_paths = [
+            "/admin", "/admin/", "/api/admin", "/dashboard",
+            "/api/users", "/api/user", "/api/profile",
+            "/settings", "/api/settings", "/api/config",
+            "/api/internal", "/internal", "/debug",
+            "/api/me", "/api/account", "/api/account/settings",
+            "/api/billing", "/api/keys", "/api/secrets",
+        ]
+
+        for path in protected_paths:
+            url = f"{base_url}{path}"
+            try:
+                response, evidence = await self.client.get(url)
+                if response.status_code == 200:
+                    body_lower = response.text.lower()
+                    # Confirm it's actual content, not a redirect or error page
+                    if not any(x in body_lower for x in [
+                        "login", "sign in", "unauthorized", "forbidden",
+                    ]):
+                        evidence.confidence = 0.7
+                        findings.append(Finding(
+                            title=f"Unauthenticated access to {path}",
+                            severity=Severity.HIGH,
+                            evidence=evidence,
+                            description=(
+                                f"The endpoint {path} is accessible without any "
+                                f"authentication. This may expose sensitive data "
+                                f"or administrative functions."
+                            ),
+                            remediation="Implement authentication middleware to protect this endpoint.",
+                            cwe="CWE-306",
+                            owasp="A07:2021 - Identification and Authentication Failures",
+                            scanner="auth",
+                            tags=["missing-auth", "no-auth"],
+                        ))
+            except Exception:
+                continue
+
+        return findings
+
+    async def _test_jwt_weaknesses(
+        self, endpoints: list[str], base_url: str
+    ) -> list[Finding]:
+        """Test for JWT implementation weaknesses.
+
+        Tests: empty JWT, unsigned JWT, algorithm none, expired JWT,
+        malformed token, missing signature.
+        """
+        findings: list[Finding] = []
+
+        # Build test JWTs
+        test_jwts = _build_jwt_test_cases()
+
+        for jwt_header, jwt_desc in test_jwts:
+            for endpoint in endpoints[:15]:
+                try:
+                    headers = {"Authorization": f"Bearer {jwt_header}"} if jwt_header else {}
+                    response, evidence = await self.client.get(endpoint, headers=headers)
+                    if response.status_code == 200 and jwt_header:
+                        evidence.confidence = 0.8
+                        findings.append(Finding(
+                            title=f"Weak JWT accepted: {jwt_desc} at {endpoint}",
+                            severity=Severity.CRITICAL,
+                            evidence=evidence,
+                            description=(
+                                f"The endpoint accepted {jwt_desc}. "
+                                f"This indicates weak token validation that could "
+                                f"allow authentication bypass."
+                            ),
+                            remediation=(
+                                "Validate JWT signatures, algorithm, expiration. "
+                                "Reject 'none' algorithm. Enforce signature verification."
+                            ),
+                            cwe="CWE-347",
+                            owasp="A07:2021 - Identification and Authentication Failures",
+                            scanner="auth",
+                            tags=["jwt", "weak-auth", "jwt-weakness"],
+                        ))
+                        break  # One finding per JWT type
+                except Exception:
+                    continue
+
+        return findings
+
+    async def _test_session_fixation(self, base_url: str) -> list[Finding]:
+        """Test for session fixation vulnerabilities.
+
+        Checks if session cookie changes after login attempt.
+        """
+        findings: list[Finding] = []
+
+        try:
+            # Make initial request to get session
+            response1, _ = await self.client.get(f"{base_url}/")
+            if response1.status_code != 200:
+                return findings
+
+            session_cookies = dict(response1.cookies)
+            if not session_cookies:
+                return findings
+
+            # Make login request keeping the same session cookie
+            response2, evidence = await self.client.post(
+                f"{base_url}/login",
+                json_data={"username": "test", "password": "test"},
+            )
+
+            new_cookies = dict(response2.cookies)
+            # Check if session cookie was NOT regenerated
+            for cookie_name in session_cookies:
+                if cookie_name in new_cookies:
+                    if new_cookies[cookie_name] == session_cookies[cookie_name]:
+                        evidence.confidence = 0.6
+                        findings.append(Finding(
+                            title="Potential session fixation",
+                            severity=Severity.MEDIUM,
+                            evidence=evidence,
+                            description=(
+                                f"The session cookie '{cookie_name}' did not change "
+                                f"after login, which may indicate session fixation. "
+                                f"An attacker could set a known session ID before the "
+                                f"user authenticates."
+                            ),
+                            remediation="Regenerate session ID after successful authentication.",
+                            cwe="CWE-384",
+                            owasp="A07:2021 - Identification and Authentication Failures",
+                            scanner="auth",
+                            tags=["session-fixation"],
+                        ))
+        except Exception:
+            pass
+
+        return findings
+
+    async def _test_cookie_security(self, base_url: str) -> list[Finding]:
+        """Test for insecure cookie configurations."""
+        findings: list[Finding] = []
+
+        try:
+            response, evidence = await self.client.get(base_url)
+            set_cookie_headers = []
+            for key, value in response.headers.items():
+                if key.lower() == "set-cookie":
+                    set_cookie_headers.append(value)
+
+            if not set_cookie_headers:
+                return findings
+
+            for cookie_header in set_cookie_headers:
+                cookie_lower = cookie_header.lower()
+
+                # Missing Secure flag
+                if "secure" not in cookie_lower:
+                    evidence.confidence = 0.6
+                    findings.append(Finding(
+                        title="Cookie missing Secure flag",
+                        severity=Severity.MEDIUM,
+                        evidence=evidence,
+                        description=(
+                            f"Cookie '{cookie_header[:60]}...' is set without "
+                            f"the Secure flag, allowing it to be sent over HTTP."
+                        ),
+                        remediation="Set the Secure flag on all session cookies.",
+                        cwe="CWE-614",
+                        owasp="A05:2021 - Security Misconfiguration",
+                        scanner="auth",
+                        tags=["cookie", "insecure-flag"],
+                    ))
+                    break  # One finding per type
+
+                # Missing HttpOnly flag
+                if "httponly" not in cookie_lower:
+                    evidence.confidence = 0.6
+                    findings.append(Finding(
+                        title="Cookie missing HttpOnly flag",
+                        severity=Severity.MEDIUM,
+                        evidence=evidence,
+                        description=(
+                            f"Cookie '{cookie_header[:60]}...' is set without "
+                            f"the HttpOnly flag, exposing it to XSS attacks."
+                        ),
+                        remediation="Set the HttpOnly flag on all session cookies.",
+                        cwe="CWE-1004",
+                        owasp="A05:2021 - Security Misconfiguration",
+                        scanner="auth",
+                        tags=["cookie", "httponly"],
+                    ))
+                    break
+
+                # Missing SameSite attribute
+                if "samesite" not in cookie_lower:
+                    evidence.confidence = 0.5
+                    findings.append(Finding(
+                        title="Cookie missing SameSite attribute",
+                        severity=Severity.LOW,
+                        evidence=evidence,
+                        description=(
+                            f"Cookie '{cookie_header[:60]}...' is set without "
+                            f"the SameSite attribute."
+                        ),
+                        remediation="Set SameSite=Strict or SameSite=Lax on cookies.",
+                        cwe="CWE-1275",
+                        owasp="A05:2021 - Security Misconfiguration",
+                        scanner="auth",
+                        tags=["cookie", "samesite"],
+                    ))
+                    break
+
+        except Exception:
+            pass
+
+        return findings
+
+
+def _build_jwt_test_cases() -> list[tuple[str, str]]:
+    """Build JWT test cases for weakness testing."""
+    cases = []
+
+    # 1. Empty JWT
+    cases.append(("", "empty Bearer token"))
+
+    # 2. Unsigned JWT (alg: none)
+    header_b64 = base64.urlsafe_b64encode(
+        json.dumps({"alg": "none", "typ": "JWT"}).encode()
+    ).rstrip(b"=").decode()
+    payload_b64 = base64.urlsafe_b64encode(
+        json.dumps({"sub": "1", "name": "admin", "role": "admin"}).encode()
+    ).rstrip(b"=").decode()
+    cases.append((f"{header_b64}.{payload_b64}.", "unsigned JWT (alg: none)"))
+
+    # 3. JWT with "none" algorithm variant
+    header_b64 = base64.urlsafe_b64encode(
+        json.dumps({"alg": "None", "typ": "JWT"}).encode()
+    ).rstrip(b"=").decode()
+    cases.append((f"{header_b64}.{payload_b64}.", "JWT with None algorithm (mixed case)"))
+
+    # 4. Expired JWT
+    expired_payload = base64.urlsafe_b64encode(
+        json.dumps({
+            "sub": "1",
+            "exp": int(time.time()) - 3600,  # 1 hour ago
+            "iat": int(time.time()) - 7200,
+        }).encode()
+    ).rstrip(b"=").decode()
+    header_hs256 = base64.urlsafe_b64encode(
+        json.dumps({"alg": "HS256", "typ": "JWT"}).encode()
+    ).rstrip(b"=").decode()
+    cases.append((
+        f"{header_hs256}.{expired_payload}.fake_signature",
+        "expired JWT",
+    ))
+
+    # 5. JWT with no signature
+    cases.append((
+        f"{header_hs256}.{payload_b64}",
+        "JWT with missing signature",
+    ))
+
+    # 6. Malformed token
+    cases.append(("not.a.valid.jwt.token", "malformed JWT token"))
+
+    # 7. Just "Bearer" with no token
+    cases.append(("Bearer", "Bearer keyword with no token"))
+
+    return cases

stryx/scanners/authorization.py

@@ -0,0 +1,220 @@
+"""Authorization vulnerability scanner.
+
+Tests for IDOR, horizontal/vertical privilege escalation, multi-tenant escape,
+admin endpoint access, and resource ownership bypass.
+Uses the ReplayEngine for proper IDOR testing.
+"""
+
+from __future__ import annotations
+
+from stryx.attacks.replay import ReplayEngine
+from stryx.utils.evidence import Finding, Severity
+from stryx.utils.http_client import HttpClient
+from stryx.utils.logging import get_logger
+
+logger = get_logger("scanner.authorization")
+
+
+class AuthorizationScanner:
+    """Scanner for authorization vulnerabilities."""
+
+    def __init__(self, client: HttpClient):
+        self.client = client
+        self.replay = ReplayEngine(client)
+
+    async def scan(
+        self, endpoints: list[str], base_url: str, cookies: str = ""
+    ) -> list[Finding]:
+        """Run authorization tests."""
+        findings: list[Finding] = []
+        logger.info("Running authorization scanner")
+
+        # Test IDOR on discovered endpoints with numeric IDs
+        findings.extend(await self._test_idor(endpoints, base_url, cookies))
+
+        # Test privilege escalation
+        findings.extend(await self._test_privilege_escalation(endpoints, base_url, cookies))
+
+        # Test admin access
+        findings.extend(await self._test_admin_access(base_url, cookies))
+
+        # Test horizontal privilege escalation
+        findings.extend(await self._test_horizontal_escalation(endpoints, base_url, cookies))
+
+        logger.info(f"Authorization scanner found {len(findings)} findings")
+        return findings
+
+    async def _test_idor(
+        self, endpoints: list[str], base_url: str, cookies: str
+    ) -> list[Finding]:
+        """Test for Insecure Direct Object Reference using replay engine."""
+        findings: list[Finding] = []
+
+        # Find endpoints that likely contain IDs
+        idor_candidates = [
+            ep for ep in endpoints
+            if ReplayEngine.is_idor_candidate(ep)
+        ]
+
+        # If no IDOR candidates from endpoints, test common patterns
+        if not idor_candidates:
+            idor_candidates = [
+                f"{base_url}/api/users/1",
+                f"{base_url}/api/users/2",
+                f"{base_url}/api/orders/1",
+                f"{base_url}/api/orders/2",
+                f"{base_url}/api/documents/1",
+                f"{base_url}/api/documents/2",
+                f"{base_url}/users/1",
+                f"{base_url}/profile/1",
+            ]
+
+        cookie_dict = _parse_cookies(cookies)
+
+        for url in idor_candidates:
+            # Extract IDs from the URL
+            ids = ReplayEngine.extract_ids_from_url(url)
+            if not ids:
+                continue
+
+            original_id = ids[0]
+            finding = await self.replay.test_idor(
+                url=url,
+                original_id=original_id,
+                headers={"Cookie": _format_cookies(cookie_dict)} if cookie_dict else None,
+            )
+            if finding:
+                findings.append(finding)
+                break  # One IDOR finding is sufficient
+
+        return findings
+
+    async def _test_privilege_escalation(
+        self, endpoints: list[str], base_url: str, cookies: str
+    ) -> list[Finding]:
+        """Test for privilege escalation."""
+        findings: list[Finding] = []
+        cookie_dict = _parse_cookies(cookies)
+
+        # Test vertical escalation - accessing admin endpoints as regular user
+        admin_paths = [
+            "/admin", "/admin/", "/api/admin", "/api/admin/users",
+            "/api/admin/config", "/api/admin/settings",
+            "/api/admin/stats", "/api/admin/logs",
+        ]
+
+        for path in admin_paths:
+            url = f"{base_url}{path}"
+            try:
+                response, evidence = await self.client.get(url, cookies=cookie_dict)
+                if response.status_code == 200:
+                    evidence.confidence = 0.7
+                    findings.append(Finding(
+                        title=f"Admin endpoint accessible: {path}",
+                        severity=Severity.CRITICAL,
+                        evidence=evidence,
+                        description=(
+                            f"The admin endpoint {path} is accessible. "
+                            f"This may allow privilege escalation."
+                        ),
+                        remediation="Restrict admin endpoints to authorized administrators.",
+                        cwe="CWE-269",
+                        owasp="A01:2021 - Broken Access Control",
+                        scanner="authorization",
+                        tags=["privilege-escalation", "admin-access"],
+                    ))
+            except Exception:
+                continue
+
+        return findings
+
+    async def _test_admin_access(
+        self, base_url: str, cookies: str
+    ) -> list[Finding]:
+        """Test for unauthorized admin access."""
+        findings: list[Finding] = []
+
+        # Try accessing admin with and without auth
+        admin_endpoints = [
+            "/admin", "/admin/dashboard", "/api/admin",
+            "/admin/panel", "/administrator",
+        ]
+
+        for path in admin_endpoints:
+            # Without cookies
+            try:
+                url = f"{base_url}{path}"
+                response, evidence = await self.client.get(url)
+                if response.status_code == 200:
+                    evidence.confidence = 0.8
+                    findings.append(Finding(
+                        title=f"Admin panel accessible without auth: {path}",
+                        severity=Severity.CRITICAL,
+                        evidence=evidence,
+                        description=(
+                            f"The admin panel at {path} is accessible without "
+                            f"authentication. This is a critical security issue."
+                        ),
+                        remediation=(
+                            "Implement authentication and authorization "
+                            "for admin interfaces."
+                        ),
+                        cwe="CWE-284",
+                        owasp="A01:2021 - Broken Access Control",
+                        scanner="authorization",
+                        tags=["admin-panel", "no-auth"],
+                    ))
+            except Exception:
+                continue
+
+        return findings
+
+    async def _test_horizontal_escalation(
+        self, endpoints: list[str], base_url: str, cookies: str
+    ) -> list[Finding]:
+        """Test horizontal privilege escalation across user resources."""
+        findings: list[Finding] = []
+        cookie_dict = _parse_cookies(cookies)
+
+        # Find endpoints with {user_id} pattern or numeric IDs
+        user_endpoints = [
+            ep for ep in endpoints
+            if "{user_id}" in ep or "/users/" in ep or "/profile/" in ep
+        ]
+
+        # Add common patterns if none found
+        if not user_endpoints:
+            user_endpoints = [
+                f"{base_url}/api/users/{{user_id}}",
+                f"{base_url}/api/profile/{{user_id}}",
+                f"{base_url}/users/{{user_id}}",
+            ]
+
+        for url_template in user_endpoints:
+            finding = await self.replay.test_horizontal_escalation(
+                url=url_template,
+                user_ids=["1", "2", "3", "4", "5"],
+                headers={"Cookie": _format_cookies(cookie_dict)} if cookie_dict else None,
+            )
+            if finding:
+                findings.append(finding)
+                break  # One finding is sufficient
+
+        return findings
+
+
+def _parse_cookies(cookie_str: str) -> dict[str, str]:
+    """Parse cookie string into dictionary."""
+    cookies: dict[str, str] = {}
+    if not cookie_str:
+        return cookies
+    for pair in cookie_str.split(";"):
+        if "=" in pair:
+            key, value = pair.split("=", 1)
+            cookies[key.strip()] = value.strip()
+    return cookies
+
+
+def _format_cookies(cookie_dict: dict[str, str]) -> str:
+    """Format cookie dictionary as Cookie header string."""
+    return "; ".join(f"{k}={v}" for k, v in cookie_dict.items())