vamp-oauth-audit 1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- vamp_oauth_audit-1.0/PKG-INFO +196 -0
- vamp_oauth_audit-1.0/README.md +175 -0
- vamp_oauth_audit-1.0/pyproject.toml +36 -0
- vamp_oauth_audit-1.0/setup.cfg +4 -0
- vamp_oauth_audit-1.0/vamp_oauth_audit.egg-info/PKG-INFO +196 -0
- vamp_oauth_audit-1.0/vamp_oauth_audit.egg-info/SOURCES.txt +9 -0
- vamp_oauth_audit-1.0/vamp_oauth_audit.egg-info/dependency_links.txt +1 -0
- vamp_oauth_audit-1.0/vamp_oauth_audit.egg-info/entry_points.txt +2 -0
- vamp_oauth_audit-1.0/vamp_oauth_audit.egg-info/requires.txt +2 -0
- vamp_oauth_audit-1.0/vamp_oauth_audit.egg-info/top_level.txt +1 -0
- vamp_oauth_audit-1.0/vamp_oauth_audit.py +1429 -0
|
@@ -0,0 +1,196 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: vamp-oauth-audit
|
|
3
|
+
Version: 1.0
|
|
4
|
+
Summary: OAuth 2.0 and OIDC security flow auditor
|
|
5
|
+
Author-email: VampSecure Studios <contact@vampsecurestudios.com>
|
|
6
|
+
License: MIT
|
|
7
|
+
Project-URL: Homepage, https://github.com/Vampsecure-Labs/vamp-oauth-audit
|
|
8
|
+
Project-URL: Repository, https://github.com/Vampsecure-Labs/vamp-oauth-audit
|
|
9
|
+
Keywords: security,pentest,audit,cybersecurity,vampsecure,oauth,oidc,jwt,authentication
|
|
10
|
+
Classifier: Development Status :: 5 - Production/Stable
|
|
11
|
+
Classifier: Environment :: Console
|
|
12
|
+
Classifier: Intended Audience :: Information Technology
|
|
13
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
14
|
+
Classifier: Operating System :: OS Independent
|
|
15
|
+
Classifier: Programming Language :: Python :: 3
|
|
16
|
+
Classifier: Topic :: Security
|
|
17
|
+
Requires-Python: >=3.9
|
|
18
|
+
Description-Content-Type: text/markdown
|
|
19
|
+
Requires-Dist: aiohttp>=3.9.0
|
|
20
|
+
Requires-Dist: rich>=13.7.0
|
|
21
|
+
|
|
22
|
+
# vamp-oauth-audit
|
|
23
|
+
|
|
24
|
+
**OAuth 2.0 and OIDC Security Flow Auditor** — VampSecure Labs Security Research Division
|
|
25
|
+
|
|
26
|
+
Herramienta CLI para auditar configuraciones OAuth 2.0 y OIDC en busca de vulnerabilidades de seguridad.
|
|
27
|
+
Analiza endpoints de discovery, URLs de autorización, tokens JWT, token endpoints activos y validación de redirect_uri.
|
|
28
|
+
|
|
29
|
+
---
|
|
30
|
+
|
|
31
|
+
## Instalación
|
|
32
|
+
|
|
33
|
+
```bash
|
|
34
|
+
pip install vamp-oauth-audit
|
|
35
|
+
```
|
|
36
|
+
|
|
37
|
+
O desde el repositorio:
|
|
38
|
+
|
|
39
|
+
```bash
|
|
40
|
+
git clone https://github.com/Vampsecure-Labs/vamp-oauth-audit
|
|
41
|
+
cd vamp-oauth-audit
|
|
42
|
+
pip install -e .
|
|
43
|
+
```
|
|
44
|
+
|
|
45
|
+
**Dependencias:** Python ≥ 3.9, `aiohttp>=3.9.0`, `rich>=13.7.0`
|
|
46
|
+
|
|
47
|
+
---
|
|
48
|
+
|
|
49
|
+
## Modos de uso
|
|
50
|
+
|
|
51
|
+
### 1. Auditoría completa por target (discovery OIDC automático)
|
|
52
|
+
|
|
53
|
+
```bash
|
|
54
|
+
vamp-oauth-audit --target auth.ejemplo.com
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
Construye automáticamente `https://auth.ejemplo.com/.well-known/openid-configuration`,
|
|
58
|
+
analiza la configuración del servidor y sondea el token endpoint descubierto.
|
|
59
|
+
|
|
60
|
+
### 2. Análisis de URL de autorización OAuth
|
|
61
|
+
|
|
62
|
+
```bash
|
|
63
|
+
vamp-oauth-audit --auth-url "https://auth.ejemplo.com/oauth/authorize?response_type=code&client_id=mi-app&redirect_uri=https://app.com/callback"
|
|
64
|
+
```
|
|
65
|
+
|
|
66
|
+
Detecta ausencia de PKCE, state, implicit flow, redirect_uri insegura y combinaciones de scopes peligrosas.
|
|
67
|
+
|
|
68
|
+
### 3. Inspección de tokens JWT
|
|
69
|
+
|
|
70
|
+
```bash
|
|
71
|
+
vamp-oauth-audit \
|
|
72
|
+
--access-token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... \
|
|
73
|
+
--id-token eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9... \
|
|
74
|
+
--client-id mi-app-id
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
Decodifica los tokens (sin verificar firma) y detecta alg=none, TTL excesivo, PII en claims y audience incorrecta.
|
|
78
|
+
|
|
79
|
+
### 4. Auditoría con proxy (Burp Suite / OWASP ZAP)
|
|
80
|
+
|
|
81
|
+
```bash
|
|
82
|
+
vamp-oauth-audit \
|
|
83
|
+
--target auth.ejemplo.com \
|
|
84
|
+
--proxy http://127.0.0.1:8080 \
|
|
85
|
+
--no-ssl-verify
|
|
86
|
+
```
|
|
87
|
+
|
|
88
|
+
Enruta el tráfico a través del proxy configurado para análisis manual paralelo.
|
|
89
|
+
|
|
90
|
+
### 5. Informe completo con salida HTML y JSON
|
|
91
|
+
|
|
92
|
+
```bash
|
|
93
|
+
vamp-oauth-audit \
|
|
94
|
+
--target auth.ejemplo.com \
|
|
95
|
+
--auth-url "https://auth.ejemplo.com/authorize?client_id=app&response_type=token" \
|
|
96
|
+
--access-token eyJhbG... \
|
|
97
|
+
--html informe_oauth.html \
|
|
98
|
+
--json hallazgos.json \
|
|
99
|
+
--min-severity HIGH
|
|
100
|
+
```
|
|
101
|
+
|
|
102
|
+
---
|
|
103
|
+
|
|
104
|
+
## Tabla de findings detectados
|
|
105
|
+
|
|
106
|
+
| ID | Severidad | Fase | Descripción |
|
|
107
|
+
|------------|-----------|---------------|----------------------------------------------------------|
|
|
108
|
+
| OAUTH-000 | INFO | Discovery | Sin endpoint de descubrimiento OIDC |
|
|
109
|
+
| OAUTH-001 | HIGH | Discovery | Servidor no anuncia soporte PKCE S256 |
|
|
110
|
+
| OAUTH-002 | MEDIUM | Discovery | Implicit flow soportado por el servidor |
|
|
111
|
+
| OAUTH-003 | HIGH | Discovery | Servidor acepta clientes públicos sin autenticación |
|
|
112
|
+
| OAUTH-004 | HIGH | Discovery | ROPC grant soportado (OWASP API8:2023) |
|
|
113
|
+
| OAUTH-005 | CRITICAL | Discovery | Token endpoint sin TLS |
|
|
114
|
+
| OAUTH-010 | CRITICAL | Auth URL | Parámetro state ausente — flujo vulnerable a CSRF |
|
|
115
|
+
| OAUTH-011 | HIGH | Auth URL | PKCE no utilizado — vulnerable a code interception |
|
|
116
|
+
| OAUTH-012 | HIGH | Auth URL | Implicit flow detectado (obsoleto en OAuth 2.1) |
|
|
117
|
+
| OAUTH-013 | HIGH | Auth URL | id_token en frontchannel — riesgo de token leakage |
|
|
118
|
+
| OAUTH-014 | MEDIUM | Auth URL | redirect_uri no especificada |
|
|
119
|
+
| OAUTH-015 | HIGH | Auth URL | redirect_uri sin TLS |
|
|
120
|
+
| OAUTH-016 | MEDIUM | Auth URL | redirect_uri a localhost (¿entorno de desarrollo?) |
|
|
121
|
+
| OAUTH-017 | MEDIUM | Auth URL | Combinación de scopes de alto privilegio |
|
|
122
|
+
| OAUTH-018 | LOW | Auth URL | Silent authentication — posible SSO bypass |
|
|
123
|
+
| OAUTH-019 | INFO | Auth URL | client_id con patrón de entorno de pruebas |
|
|
124
|
+
| OAUTH-020 | CRITICAL | Auth URL | Authorization endpoint sin TLS |
|
|
125
|
+
| OAUTH-030 | CRITICAL | Tokens | Token con alg=none — firma ignorada por diseño |
|
|
126
|
+
| OAUTH-031 | HIGH | Tokens | Token sin claim de expiración (exp) |
|
|
127
|
+
| OAUTH-032 | MEDIUM | Tokens | TTL del token superior a 24 horas |
|
|
128
|
+
| OAUTH-033 | MEDIUM | Tokens | PII expuesta en claims del token |
|
|
129
|
+
| OAUTH-034 | HIGH | Tokens | Token con scopes de alto privilegio |
|
|
130
|
+
| OAUTH-035 | MEDIUM | Tokens | id_token sin nonce — vulnerable a replay |
|
|
131
|
+
| OAUTH-036 | HIGH | Tokens | Audience del token no coincide con client_id |
|
|
132
|
+
| OAUTH-037 | INFO | Tokens | Access token firmado con HMAC simétrico |
|
|
133
|
+
| OAUTH-040 | MEDIUM | Token EP | Token endpoint acepta GET |
|
|
134
|
+
| OAUTH-041 | MEDIUM | Token EP | CORS wildcard en token endpoint |
|
|
135
|
+
| OAUTH-042 | LOW | Token EP | HSTS no configurado en token endpoint |
|
|
136
|
+
| OAUTH-043 | HIGH | Token EP | Información de depuración expuesta en errores |
|
|
137
|
+
| OAUTH-044 | CRITICAL | Token EP | Token endpoint sin TLS (confirmado activamente) |
|
|
138
|
+
| OAUTH-050 | CRITICAL | Redirect URI | Open redirect — servidor acepta redirect_uri arbitraria |
|
|
139
|
+
| OAUTH-051 | HIGH | Redirect URI | Bypass de validación redirect_uri con URL encoding |
|
|
140
|
+
|
|
141
|
+
---
|
|
142
|
+
|
|
143
|
+
## Variables de entorno
|
|
144
|
+
|
|
145
|
+
| Variable | Descripción |
|
|
146
|
+
|-----------------------------|--------------------------------------|
|
|
147
|
+
| `HTTP_PROXY` / `HTTPS_PROXY` | Proxy de red (respetado automáticamente con `--no-ssl-verify`) |
|
|
148
|
+
|
|
149
|
+
---
|
|
150
|
+
|
|
151
|
+
## Ejemplo de salida en consola
|
|
152
|
+
|
|
153
|
+
```
|
|
154
|
+
╭──────────────────────────────────────────────────────────────────╮
|
|
155
|
+
│ vamp-oauth-audit v1.0 · VampSecure Labs Security Research Division│
|
|
156
|
+
╰──────────────────────────────────────────────────────────────────╯
|
|
157
|
+
|
|
158
|
+
Fase 1 — OIDC Discovery
|
|
159
|
+
→ GET https://auth.ejemplo.com/.well-known/openid-configuration
|
|
160
|
+
|
|
161
|
+
Fase 2 — Análisis URL de autorización
|
|
162
|
+
|
|
163
|
+
Fase 4 — Sondeo activo token endpoint
|
|
164
|
+
→ Sondeo activo: https://auth.ejemplo.com/token
|
|
165
|
+
|
|
166
|
+
╭─────────────────────────────── Hallazgos ────────────────────────────────╮
|
|
167
|
+
│ ID │ Sev. │ Fase │ Descripción │
|
|
168
|
+
│ OAUTH-001 │ 🔴 HIGH │ Discovery │ Servidor no anuncia soporte PKCE │
|
|
169
|
+
│ OAUTH-010 │ 💀 CRIT │ Auth URL │ Parámetro state ausente │
|
|
170
|
+
│ OAUTH-042 │ 🔵 LOW │ Token EP │ HSTS no configurado │
|
|
171
|
+
╰──────────────────────────────────────────────────────────────────────────╯
|
|
172
|
+
|
|
173
|
+
┌─ Calificación global: D ─┐
|
|
174
|
+
|
|
175
|
+
Total: 3 hallazgos — CRITICAL=0 HIGH=1 MEDIUM=0 LOW=1 INFO=0
|
|
176
|
+
```
|
|
177
|
+
|
|
178
|
+
---
|
|
179
|
+
|
|
180
|
+
## Uso ético y aviso legal
|
|
181
|
+
|
|
182
|
+
Esta herramienta está diseñada **exclusivamente para auditorías de seguridad en sistemas propios o con autorización expresa** del propietario del sistema objetivo.
|
|
183
|
+
|
|
184
|
+
El uso de vamp-oauth-audit en sistemas sin autorización puede constituir un delito informático en la mayoría de jurisdicciones. VampSecure Studios no se responsabiliza del uso indebido de esta herramienta.
|
|
185
|
+
|
|
186
|
+
**Cumplimiento recomendado:** OWASP API Security Top 10, RFC 6749, RFC 7636 (PKCE), RFC 8252 (Native Apps), OAuth 2.1 (draft-ietf-oauth-v2-1), OpenID Connect Core.
|
|
187
|
+
|
|
188
|
+
---
|
|
189
|
+
|
|
190
|
+
## Licencia
|
|
191
|
+
|
|
192
|
+
MIT License — © VampSecure Studios
|
|
193
|
+
|
|
194
|
+
---
|
|
195
|
+
|
|
196
|
+
*© VampSecure Studios — VampSecure Labs Security Research Division*
|
|
@@ -0,0 +1,175 @@
|
|
|
1
|
+
# vamp-oauth-audit
|
|
2
|
+
|
|
3
|
+
**OAuth 2.0 and OIDC Security Flow Auditor** — VampSecure Labs Security Research Division
|
|
4
|
+
|
|
5
|
+
Herramienta CLI para auditar configuraciones OAuth 2.0 y OIDC en busca de vulnerabilidades de seguridad.
|
|
6
|
+
Analiza endpoints de discovery, URLs de autorización, tokens JWT, token endpoints activos y validación de redirect_uri.
|
|
7
|
+
|
|
8
|
+
---
|
|
9
|
+
|
|
10
|
+
## Instalación
|
|
11
|
+
|
|
12
|
+
```bash
|
|
13
|
+
pip install vamp-oauth-audit
|
|
14
|
+
```
|
|
15
|
+
|
|
16
|
+
O desde el repositorio:
|
|
17
|
+
|
|
18
|
+
```bash
|
|
19
|
+
git clone https://github.com/Vampsecure-Labs/vamp-oauth-audit
|
|
20
|
+
cd vamp-oauth-audit
|
|
21
|
+
pip install -e .
|
|
22
|
+
```
|
|
23
|
+
|
|
24
|
+
**Dependencias:** Python ≥ 3.9, `aiohttp>=3.9.0`, `rich>=13.7.0`
|
|
25
|
+
|
|
26
|
+
---
|
|
27
|
+
|
|
28
|
+
## Modos de uso
|
|
29
|
+
|
|
30
|
+
### 1. Auditoría completa por target (discovery OIDC automático)
|
|
31
|
+
|
|
32
|
+
```bash
|
|
33
|
+
vamp-oauth-audit --target auth.ejemplo.com
|
|
34
|
+
```
|
|
35
|
+
|
|
36
|
+
Construye automáticamente `https://auth.ejemplo.com/.well-known/openid-configuration`,
|
|
37
|
+
analiza la configuración del servidor y sondea el token endpoint descubierto.
|
|
38
|
+
|
|
39
|
+
### 2. Análisis de URL de autorización OAuth
|
|
40
|
+
|
|
41
|
+
```bash
|
|
42
|
+
vamp-oauth-audit --auth-url "https://auth.ejemplo.com/oauth/authorize?response_type=code&client_id=mi-app&redirect_uri=https://app.com/callback"
|
|
43
|
+
```
|
|
44
|
+
|
|
45
|
+
Detecta ausencia de PKCE, state, implicit flow, redirect_uri insegura y combinaciones de scopes peligrosas.
|
|
46
|
+
|
|
47
|
+
### 3. Inspección de tokens JWT
|
|
48
|
+
|
|
49
|
+
```bash
|
|
50
|
+
vamp-oauth-audit \
|
|
51
|
+
--access-token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... \
|
|
52
|
+
--id-token eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9... \
|
|
53
|
+
--client-id mi-app-id
|
|
54
|
+
```
|
|
55
|
+
|
|
56
|
+
Decodifica los tokens (sin verificar firma) y detecta alg=none, TTL excesivo, PII en claims y audience incorrecta.
|
|
57
|
+
|
|
58
|
+
### 4. Auditoría con proxy (Burp Suite / OWASP ZAP)
|
|
59
|
+
|
|
60
|
+
```bash
|
|
61
|
+
vamp-oauth-audit \
|
|
62
|
+
--target auth.ejemplo.com \
|
|
63
|
+
--proxy http://127.0.0.1:8080 \
|
|
64
|
+
--no-ssl-verify
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
Enruta el tráfico a través del proxy configurado para análisis manual paralelo.
|
|
68
|
+
|
|
69
|
+
### 5. Informe completo con salida HTML y JSON
|
|
70
|
+
|
|
71
|
+
```bash
|
|
72
|
+
vamp-oauth-audit \
|
|
73
|
+
--target auth.ejemplo.com \
|
|
74
|
+
--auth-url "https://auth.ejemplo.com/authorize?client_id=app&response_type=token" \
|
|
75
|
+
--access-token eyJhbG... \
|
|
76
|
+
--html informe_oauth.html \
|
|
77
|
+
--json hallazgos.json \
|
|
78
|
+
--min-severity HIGH
|
|
79
|
+
```
|
|
80
|
+
|
|
81
|
+
---
|
|
82
|
+
|
|
83
|
+
## Tabla de findings detectados
|
|
84
|
+
|
|
85
|
+
| ID | Severidad | Fase | Descripción |
|
|
86
|
+
|------------|-----------|---------------|----------------------------------------------------------|
|
|
87
|
+
| OAUTH-000 | INFO | Discovery | Sin endpoint de descubrimiento OIDC |
|
|
88
|
+
| OAUTH-001 | HIGH | Discovery | Servidor no anuncia soporte PKCE S256 |
|
|
89
|
+
| OAUTH-002 | MEDIUM | Discovery | Implicit flow soportado por el servidor |
|
|
90
|
+
| OAUTH-003 | HIGH | Discovery | Servidor acepta clientes públicos sin autenticación |
|
|
91
|
+
| OAUTH-004 | HIGH | Discovery | ROPC grant soportado (OWASP API8:2023) |
|
|
92
|
+
| OAUTH-005 | CRITICAL | Discovery | Token endpoint sin TLS |
|
|
93
|
+
| OAUTH-010 | CRITICAL | Auth URL | Parámetro state ausente — flujo vulnerable a CSRF |
|
|
94
|
+
| OAUTH-011 | HIGH | Auth URL | PKCE no utilizado — vulnerable a code interception |
|
|
95
|
+
| OAUTH-012 | HIGH | Auth URL | Implicit flow detectado (obsoleto en OAuth 2.1) |
|
|
96
|
+
| OAUTH-013 | HIGH | Auth URL | id_token en frontchannel — riesgo de token leakage |
|
|
97
|
+
| OAUTH-014 | MEDIUM | Auth URL | redirect_uri no especificada |
|
|
98
|
+
| OAUTH-015 | HIGH | Auth URL | redirect_uri sin TLS |
|
|
99
|
+
| OAUTH-016 | MEDIUM | Auth URL | redirect_uri a localhost (¿entorno de desarrollo?) |
|
|
100
|
+
| OAUTH-017 | MEDIUM | Auth URL | Combinación de scopes de alto privilegio |
|
|
101
|
+
| OAUTH-018 | LOW | Auth URL | Silent authentication — posible SSO bypass |
|
|
102
|
+
| OAUTH-019 | INFO | Auth URL | client_id con patrón de entorno de pruebas |
|
|
103
|
+
| OAUTH-020 | CRITICAL | Auth URL | Authorization endpoint sin TLS |
|
|
104
|
+
| OAUTH-030 | CRITICAL | Tokens | Token con alg=none — firma ignorada por diseño |
|
|
105
|
+
| OAUTH-031 | HIGH | Tokens | Token sin claim de expiración (exp) |
|
|
106
|
+
| OAUTH-032 | MEDIUM | Tokens | TTL del token superior a 24 horas |
|
|
107
|
+
| OAUTH-033 | MEDIUM | Tokens | PII expuesta en claims del token |
|
|
108
|
+
| OAUTH-034 | HIGH | Tokens | Token con scopes de alto privilegio |
|
|
109
|
+
| OAUTH-035 | MEDIUM | Tokens | id_token sin nonce — vulnerable a replay |
|
|
110
|
+
| OAUTH-036 | HIGH | Tokens | Audience del token no coincide con client_id |
|
|
111
|
+
| OAUTH-037 | INFO | Tokens | Access token firmado con HMAC simétrico |
|
|
112
|
+
| OAUTH-040 | MEDIUM | Token EP | Token endpoint acepta GET |
|
|
113
|
+
| OAUTH-041 | MEDIUM | Token EP | CORS wildcard en token endpoint |
|
|
114
|
+
| OAUTH-042 | LOW | Token EP | HSTS no configurado en token endpoint |
|
|
115
|
+
| OAUTH-043 | HIGH | Token EP | Información de depuración expuesta en errores |
|
|
116
|
+
| OAUTH-044 | CRITICAL | Token EP | Token endpoint sin TLS (confirmado activamente) |
|
|
117
|
+
| OAUTH-050 | CRITICAL | Redirect URI | Open redirect — servidor acepta redirect_uri arbitraria |
|
|
118
|
+
| OAUTH-051 | HIGH | Redirect URI | Bypass de validación redirect_uri con URL encoding |
|
|
119
|
+
|
|
120
|
+
---
|
|
121
|
+
|
|
122
|
+
## Variables de entorno
|
|
123
|
+
|
|
124
|
+
| Variable | Descripción |
|
|
125
|
+
|-----------------------------|--------------------------------------|
|
|
126
|
+
| `HTTP_PROXY` / `HTTPS_PROXY` | Proxy de red (respetado automáticamente con `--no-ssl-verify`) |
|
|
127
|
+
|
|
128
|
+
---
|
|
129
|
+
|
|
130
|
+
## Ejemplo de salida en consola
|
|
131
|
+
|
|
132
|
+
```
|
|
133
|
+
╭──────────────────────────────────────────────────────────────────╮
|
|
134
|
+
│ vamp-oauth-audit v1.0 · VampSecure Labs Security Research Division│
|
|
135
|
+
╰──────────────────────────────────────────────────────────────────╯
|
|
136
|
+
|
|
137
|
+
Fase 1 — OIDC Discovery
|
|
138
|
+
→ GET https://auth.ejemplo.com/.well-known/openid-configuration
|
|
139
|
+
|
|
140
|
+
Fase 2 — Análisis URL de autorización
|
|
141
|
+
|
|
142
|
+
Fase 4 — Sondeo activo token endpoint
|
|
143
|
+
→ Sondeo activo: https://auth.ejemplo.com/token
|
|
144
|
+
|
|
145
|
+
╭─────────────────────────────── Hallazgos ────────────────────────────────╮
|
|
146
|
+
│ ID │ Sev. │ Fase │ Descripción │
|
|
147
|
+
│ OAUTH-001 │ 🔴 HIGH │ Discovery │ Servidor no anuncia soporte PKCE │
|
|
148
|
+
│ OAUTH-010 │ 💀 CRIT │ Auth URL │ Parámetro state ausente │
|
|
149
|
+
│ OAUTH-042 │ 🔵 LOW │ Token EP │ HSTS no configurado │
|
|
150
|
+
╰──────────────────────────────────────────────────────────────────────────╯
|
|
151
|
+
|
|
152
|
+
┌─ Calificación global: D ─┐
|
|
153
|
+
|
|
154
|
+
Total: 3 hallazgos — CRITICAL=0 HIGH=1 MEDIUM=0 LOW=1 INFO=0
|
|
155
|
+
```
|
|
156
|
+
|
|
157
|
+
---
|
|
158
|
+
|
|
159
|
+
## Uso ético y aviso legal
|
|
160
|
+
|
|
161
|
+
Esta herramienta está diseñada **exclusivamente para auditorías de seguridad en sistemas propios o con autorización expresa** del propietario del sistema objetivo.
|
|
162
|
+
|
|
163
|
+
El uso de vamp-oauth-audit en sistemas sin autorización puede constituir un delito informático en la mayoría de jurisdicciones. VampSecure Studios no se responsabiliza del uso indebido de esta herramienta.
|
|
164
|
+
|
|
165
|
+
**Cumplimiento recomendado:** OWASP API Security Top 10, RFC 6749, RFC 7636 (PKCE), RFC 8252 (Native Apps), OAuth 2.1 (draft-ietf-oauth-v2-1), OpenID Connect Core.
|
|
166
|
+
|
|
167
|
+
---
|
|
168
|
+
|
|
169
|
+
## Licencia
|
|
170
|
+
|
|
171
|
+
MIT License — © VampSecure Studios
|
|
172
|
+
|
|
173
|
+
---
|
|
174
|
+
|
|
175
|
+
*© VampSecure Studios — VampSecure Labs Security Research Division*
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["setuptools>=68", "wheel"]
|
|
3
|
+
build-backend = "setuptools.build_meta"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "vamp-oauth-audit"
|
|
7
|
+
version = "1.0"
|
|
8
|
+
description = "OAuth 2.0 and OIDC security flow auditor"
|
|
9
|
+
readme = "README.md"
|
|
10
|
+
license = { text = "MIT" }
|
|
11
|
+
requires-python = ">=3.9"
|
|
12
|
+
authors = [{ name = "VampSecure Studios", email = "contact@vampsecurestudios.com" }]
|
|
13
|
+
keywords = ["security", "pentest", "audit", "cybersecurity", "vampsecure", "oauth", "oidc", "jwt", "authentication"]
|
|
14
|
+
classifiers = [
|
|
15
|
+
"Development Status :: 5 - Production/Stable",
|
|
16
|
+
"Environment :: Console",
|
|
17
|
+
"Intended Audience :: Information Technology",
|
|
18
|
+
"License :: OSI Approved :: MIT License",
|
|
19
|
+
"Operating System :: OS Independent",
|
|
20
|
+
"Programming Language :: Python :: 3",
|
|
21
|
+
"Topic :: Security",
|
|
22
|
+
]
|
|
23
|
+
dependencies = [
|
|
24
|
+
"aiohttp>=3.9.0",
|
|
25
|
+
"rich>=13.7.0",
|
|
26
|
+
]
|
|
27
|
+
|
|
28
|
+
[project.scripts]
|
|
29
|
+
vamp-oauth-audit = "vamp_oauth_audit:main"
|
|
30
|
+
|
|
31
|
+
[project.urls]
|
|
32
|
+
Homepage = "https://github.com/Vampsecure-Labs/vamp-oauth-audit"
|
|
33
|
+
Repository = "https://github.com/Vampsecure-Labs/vamp-oauth-audit"
|
|
34
|
+
|
|
35
|
+
[tool.setuptools]
|
|
36
|
+
py-modules = ["vamp_oauth_audit"]
|
|
@@ -0,0 +1,196 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: vamp-oauth-audit
|
|
3
|
+
Version: 1.0
|
|
4
|
+
Summary: OAuth 2.0 and OIDC security flow auditor
|
|
5
|
+
Author-email: VampSecure Studios <contact@vampsecurestudios.com>
|
|
6
|
+
License: MIT
|
|
7
|
+
Project-URL: Homepage, https://github.com/Vampsecure-Labs/vamp-oauth-audit
|
|
8
|
+
Project-URL: Repository, https://github.com/Vampsecure-Labs/vamp-oauth-audit
|
|
9
|
+
Keywords: security,pentest,audit,cybersecurity,vampsecure,oauth,oidc,jwt,authentication
|
|
10
|
+
Classifier: Development Status :: 5 - Production/Stable
|
|
11
|
+
Classifier: Environment :: Console
|
|
12
|
+
Classifier: Intended Audience :: Information Technology
|
|
13
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
14
|
+
Classifier: Operating System :: OS Independent
|
|
15
|
+
Classifier: Programming Language :: Python :: 3
|
|
16
|
+
Classifier: Topic :: Security
|
|
17
|
+
Requires-Python: >=3.9
|
|
18
|
+
Description-Content-Type: text/markdown
|
|
19
|
+
Requires-Dist: aiohttp>=3.9.0
|
|
20
|
+
Requires-Dist: rich>=13.7.0
|
|
21
|
+
|
|
22
|
+
# vamp-oauth-audit
|
|
23
|
+
|
|
24
|
+
**OAuth 2.0 and OIDC Security Flow Auditor** — VampSecure Labs Security Research Division
|
|
25
|
+
|
|
26
|
+
Herramienta CLI para auditar configuraciones OAuth 2.0 y OIDC en busca de vulnerabilidades de seguridad.
|
|
27
|
+
Analiza endpoints de discovery, URLs de autorización, tokens JWT, token endpoints activos y validación de redirect_uri.
|
|
28
|
+
|
|
29
|
+
---
|
|
30
|
+
|
|
31
|
+
## Instalación
|
|
32
|
+
|
|
33
|
+
```bash
|
|
34
|
+
pip install vamp-oauth-audit
|
|
35
|
+
```
|
|
36
|
+
|
|
37
|
+
O desde el repositorio:
|
|
38
|
+
|
|
39
|
+
```bash
|
|
40
|
+
git clone https://github.com/Vampsecure-Labs/vamp-oauth-audit
|
|
41
|
+
cd vamp-oauth-audit
|
|
42
|
+
pip install -e .
|
|
43
|
+
```
|
|
44
|
+
|
|
45
|
+
**Dependencias:** Python ≥ 3.9, `aiohttp>=3.9.0`, `rich>=13.7.0`
|
|
46
|
+
|
|
47
|
+
---
|
|
48
|
+
|
|
49
|
+
## Modos de uso
|
|
50
|
+
|
|
51
|
+
### 1. Auditoría completa por target (discovery OIDC automático)
|
|
52
|
+
|
|
53
|
+
```bash
|
|
54
|
+
vamp-oauth-audit --target auth.ejemplo.com
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
Construye automáticamente `https://auth.ejemplo.com/.well-known/openid-configuration`,
|
|
58
|
+
analiza la configuración del servidor y sondea el token endpoint descubierto.
|
|
59
|
+
|
|
60
|
+
### 2. Análisis de URL de autorización OAuth
|
|
61
|
+
|
|
62
|
+
```bash
|
|
63
|
+
vamp-oauth-audit --auth-url "https://auth.ejemplo.com/oauth/authorize?response_type=code&client_id=mi-app&redirect_uri=https://app.com/callback"
|
|
64
|
+
```
|
|
65
|
+
|
|
66
|
+
Detecta ausencia de PKCE, state, implicit flow, redirect_uri insegura y combinaciones de scopes peligrosas.
|
|
67
|
+
|
|
68
|
+
### 3. Inspección de tokens JWT
|
|
69
|
+
|
|
70
|
+
```bash
|
|
71
|
+
vamp-oauth-audit \
|
|
72
|
+
--access-token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... \
|
|
73
|
+
--id-token eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9... \
|
|
74
|
+
--client-id mi-app-id
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
Decodifica los tokens (sin verificar firma) y detecta alg=none, TTL excesivo, PII en claims y audience incorrecta.
|
|
78
|
+
|
|
79
|
+
### 4. Auditoría con proxy (Burp Suite / OWASP ZAP)
|
|
80
|
+
|
|
81
|
+
```bash
|
|
82
|
+
vamp-oauth-audit \
|
|
83
|
+
--target auth.ejemplo.com \
|
|
84
|
+
--proxy http://127.0.0.1:8080 \
|
|
85
|
+
--no-ssl-verify
|
|
86
|
+
```
|
|
87
|
+
|
|
88
|
+
Enruta el tráfico a través del proxy configurado para análisis manual paralelo.
|
|
89
|
+
|
|
90
|
+
### 5. Informe completo con salida HTML y JSON
|
|
91
|
+
|
|
92
|
+
```bash
|
|
93
|
+
vamp-oauth-audit \
|
|
94
|
+
--target auth.ejemplo.com \
|
|
95
|
+
--auth-url "https://auth.ejemplo.com/authorize?client_id=app&response_type=token" \
|
|
96
|
+
--access-token eyJhbG... \
|
|
97
|
+
--html informe_oauth.html \
|
|
98
|
+
--json hallazgos.json \
|
|
99
|
+
--min-severity HIGH
|
|
100
|
+
```
|
|
101
|
+
|
|
102
|
+
---
|
|
103
|
+
|
|
104
|
+
## Tabla de findings detectados
|
|
105
|
+
|
|
106
|
+
| ID | Severidad | Fase | Descripción |
|
|
107
|
+
|------------|-----------|---------------|----------------------------------------------------------|
|
|
108
|
+
| OAUTH-000 | INFO | Discovery | Sin endpoint de descubrimiento OIDC |
|
|
109
|
+
| OAUTH-001 | HIGH | Discovery | Servidor no anuncia soporte PKCE S256 |
|
|
110
|
+
| OAUTH-002 | MEDIUM | Discovery | Implicit flow soportado por el servidor |
|
|
111
|
+
| OAUTH-003 | HIGH | Discovery | Servidor acepta clientes públicos sin autenticación |
|
|
112
|
+
| OAUTH-004 | HIGH | Discovery | ROPC grant soportado (OWASP API8:2023) |
|
|
113
|
+
| OAUTH-005 | CRITICAL | Discovery | Token endpoint sin TLS |
|
|
114
|
+
| OAUTH-010 | CRITICAL | Auth URL | Parámetro state ausente — flujo vulnerable a CSRF |
|
|
115
|
+
| OAUTH-011 | HIGH | Auth URL | PKCE no utilizado — vulnerable a code interception |
|
|
116
|
+
| OAUTH-012 | HIGH | Auth URL | Implicit flow detectado (obsoleto en OAuth 2.1) |
|
|
117
|
+
| OAUTH-013 | HIGH | Auth URL | id_token en frontchannel — riesgo de token leakage |
|
|
118
|
+
| OAUTH-014 | MEDIUM | Auth URL | redirect_uri no especificada |
|
|
119
|
+
| OAUTH-015 | HIGH | Auth URL | redirect_uri sin TLS |
|
|
120
|
+
| OAUTH-016 | MEDIUM | Auth URL | redirect_uri a localhost (¿entorno de desarrollo?) |
|
|
121
|
+
| OAUTH-017 | MEDIUM | Auth URL | Combinación de scopes de alto privilegio |
|
|
122
|
+
| OAUTH-018 | LOW | Auth URL | Silent authentication — posible SSO bypass |
|
|
123
|
+
| OAUTH-019 | INFO | Auth URL | client_id con patrón de entorno de pruebas |
|
|
124
|
+
| OAUTH-020 | CRITICAL | Auth URL | Authorization endpoint sin TLS |
|
|
125
|
+
| OAUTH-030 | CRITICAL | Tokens | Token con alg=none — firma ignorada por diseño |
|
|
126
|
+
| OAUTH-031 | HIGH | Tokens | Token sin claim de expiración (exp) |
|
|
127
|
+
| OAUTH-032 | MEDIUM | Tokens | TTL del token superior a 24 horas |
|
|
128
|
+
| OAUTH-033 | MEDIUM | Tokens | PII expuesta en claims del token |
|
|
129
|
+
| OAUTH-034 | HIGH | Tokens | Token con scopes de alto privilegio |
|
|
130
|
+
| OAUTH-035 | MEDIUM | Tokens | id_token sin nonce — vulnerable a replay |
|
|
131
|
+
| OAUTH-036 | HIGH | Tokens | Audience del token no coincide con client_id |
|
|
132
|
+
| OAUTH-037 | INFO | Tokens | Access token firmado con HMAC simétrico |
|
|
133
|
+
| OAUTH-040 | MEDIUM | Token EP | Token endpoint acepta GET |
|
|
134
|
+
| OAUTH-041 | MEDIUM | Token EP | CORS wildcard en token endpoint |
|
|
135
|
+
| OAUTH-042 | LOW | Token EP | HSTS no configurado en token endpoint |
|
|
136
|
+
| OAUTH-043 | HIGH | Token EP | Información de depuración expuesta en errores |
|
|
137
|
+
| OAUTH-044 | CRITICAL | Token EP | Token endpoint sin TLS (confirmado activamente) |
|
|
138
|
+
| OAUTH-050 | CRITICAL | Redirect URI | Open redirect — servidor acepta redirect_uri arbitraria |
|
|
139
|
+
| OAUTH-051 | HIGH | Redirect URI | Bypass de validación redirect_uri con URL encoding |
|
|
140
|
+
|
|
141
|
+
---
|
|
142
|
+
|
|
143
|
+
## Variables de entorno
|
|
144
|
+
|
|
145
|
+
| Variable | Descripción |
|
|
146
|
+
|-----------------------------|--------------------------------------|
|
|
147
|
+
| `HTTP_PROXY` / `HTTPS_PROXY` | Proxy de red (respetado automáticamente con `--no-ssl-verify`) |
|
|
148
|
+
|
|
149
|
+
---
|
|
150
|
+
|
|
151
|
+
## Ejemplo de salida en consola
|
|
152
|
+
|
|
153
|
+
```
|
|
154
|
+
╭──────────────────────────────────────────────────────────────────╮
|
|
155
|
+
│ vamp-oauth-audit v1.0 · VampSecure Labs Security Research Division│
|
|
156
|
+
╰──────────────────────────────────────────────────────────────────╯
|
|
157
|
+
|
|
158
|
+
Fase 1 — OIDC Discovery
|
|
159
|
+
→ GET https://auth.ejemplo.com/.well-known/openid-configuration
|
|
160
|
+
|
|
161
|
+
Fase 2 — Análisis URL de autorización
|
|
162
|
+
|
|
163
|
+
Fase 4 — Sondeo activo token endpoint
|
|
164
|
+
→ Sondeo activo: https://auth.ejemplo.com/token
|
|
165
|
+
|
|
166
|
+
╭─────────────────────────────── Hallazgos ────────────────────────────────╮
|
|
167
|
+
│ ID │ Sev. │ Fase │ Descripción │
|
|
168
|
+
│ OAUTH-001 │ 🔴 HIGH │ Discovery │ Servidor no anuncia soporte PKCE │
|
|
169
|
+
│ OAUTH-010 │ 💀 CRIT │ Auth URL │ Parámetro state ausente │
|
|
170
|
+
│ OAUTH-042 │ 🔵 LOW │ Token EP │ HSTS no configurado │
|
|
171
|
+
╰──────────────────────────────────────────────────────────────────────────╯
|
|
172
|
+
|
|
173
|
+
┌─ Calificación global: D ─┐
|
|
174
|
+
|
|
175
|
+
Total: 3 hallazgos — CRITICAL=0 HIGH=1 MEDIUM=0 LOW=1 INFO=0
|
|
176
|
+
```
|
|
177
|
+
|
|
178
|
+
---
|
|
179
|
+
|
|
180
|
+
## Uso ético y aviso legal
|
|
181
|
+
|
|
182
|
+
Esta herramienta está diseñada **exclusivamente para auditorías de seguridad en sistemas propios o con autorización expresa** del propietario del sistema objetivo.
|
|
183
|
+
|
|
184
|
+
El uso de vamp-oauth-audit en sistemas sin autorización puede constituir un delito informático en la mayoría de jurisdicciones. VampSecure Studios no se responsabiliza del uso indebido de esta herramienta.
|
|
185
|
+
|
|
186
|
+
**Cumplimiento recomendado:** OWASP API Security Top 10, RFC 6749, RFC 7636 (PKCE), RFC 8252 (Native Apps), OAuth 2.1 (draft-ietf-oauth-v2-1), OpenID Connect Core.
|
|
187
|
+
|
|
188
|
+
---
|
|
189
|
+
|
|
190
|
+
## Licencia
|
|
191
|
+
|
|
192
|
+
MIT License — © VampSecure Studios
|
|
193
|
+
|
|
194
|
+
---
|
|
195
|
+
|
|
196
|
+
*© VampSecure Studios — VampSecure Labs Security Research Division*
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
README.md
|
|
2
|
+
pyproject.toml
|
|
3
|
+
vamp_oauth_audit.py
|
|
4
|
+
vamp_oauth_audit.egg-info/PKG-INFO
|
|
5
|
+
vamp_oauth_audit.egg-info/SOURCES.txt
|
|
6
|
+
vamp_oauth_audit.egg-info/dependency_links.txt
|
|
7
|
+
vamp_oauth_audit.egg-info/entry_points.txt
|
|
8
|
+
vamp_oauth_audit.egg-info/requires.txt
|
|
9
|
+
vamp_oauth_audit.egg-info/top_level.txt
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
vamp_oauth_audit
|