diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000000000000000000000000000000000000..fb26134bd21dbe443332a328e852832862a105ef --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +screenshots/ +secret-file.yaml diff --git a/README.md b/README.md index 957edff907217eb29e6c0e770628e358a1220b0c..a115ff23e6ad6db5fab306612f343e4fde6200fb 100644 --- a/README.md +++ b/README.md @@ -29,39 +29,66 @@ docker run --rm -v ./:/app/ projectdiscovery/nuclei # ... ### conformance IdP -You need to setup a conformance IdP, with a module developed for SAML signature validation testing. +You need to setup a [conformance IdP](https://gitlab.software.geant.org/TI_Incubator/conformance-idp-deployment), +with a [module](https://github.com/cicnavi/simplesamlphp-module-conformance) developed for SAML signature validation testing. Then you need to connect SPs to the conformance IdP (exchange metadata), so that regular SAML authentication works. ## Usage +### Raw HTTP test (fast, no screenshots) + +Make a copy of `secret-file.example.yaml` to `secret-file.yaml` and put in your authorization token for the conformance IdP. + Run against one target: ```sh -nuclei --headless -u ACS_URL_HERE -V "SP_ENTITY_ID=ENTITY_ID_HERE" -V "AUTHORIZATION=AUTHORIZATION_HERE" \ - -duc -ms -t nuclei-templates/ -nmhe -lna -dka 30 -dt 30 +nuclei -u ACS_URL_HERE -V "SP_ENTITY_ID=ENTITY_ID_HERE" -secret-file secret-file.yaml \ + -duc -ms -t nuclei-templates/ -nmhe -lna -dka 30 -dt 30 -tags raw ``` or using docker: ```sh -docker run --rm -v ./:/app/ projectdiscovery/nuclei --headless -u ACS_URL_HERE -V "SP_ENTITY_ID=ENTITY_ID_HERE" -V "AUTHORIZATION=AUTHORIZATION_HERE" \ - -duc -ms -t /app/nuclei-templates/ -nmhe -lna -dka 30 -dt 30 +docker run --rm -v ./:/app/ projectdiscovery/nuclei -u ACS_URL_HERE -V "SP_ENTITY_ID=ENTITY_ID_HERE" -secret-file secret-file.yaml \ + -duc -ms -t /app/nuclei-templates/ -nmhe -lna -dka 30 -dt 30 -tags raw ``` where * `ACS_URL_HERE` is the assertion consumer service endpoint URL * `ENTITY_ID_HERE` is the entity ID of the SP -* `AUTHORIZATION_HERE` is the authorization header, e.g. `Bearer abcd...789` It is expected that the SP will return HTTP code 200/302/303 on success and a different HTTP code on failure (e.g. when SAML response is not signed). -## Limitations +### Headless browser test (slower, with screenshots) + +Run against one target: + +```sh +nuclei --headless -u ACS_URL_HERE -V "SP_ENTITY_ID=ENTITY_ID_HERE" -V "BEARER_TOKEN=BEARER_TOKEN_HERE" \ + -duc -ms -t nuclei-templates/ -nmhe -lna -dka 30 -dt 30 -tags headless +``` + +or using docker: + +```sh +docker run --rm -v ./:/app/ projectdiscovery/nuclei --headless -u ACS_URL_HERE -V "SP_ENTITY_ID=ENTITY_ID_HERE" -V "BEARER_TOKEN=BEARER_TOKEN_HERE" \ + -duc -ms -t /app/nuclei-templates/ -nmhe -lna -dka 30 -dt 30 -tags headless +``` + +where + +* `ACS_URL_HERE` is the assertion consumer service endpoint URL +* `ENTITY_ID_HERE` is the entity ID of the SP +* `BEARER_TOKEN_HERE` is your authorization token for the conformance IdP + +## Current limitations * templates are only usable with the conformace IdP * testing cannot be run in parallel for the same entity ID * only `HTTP-POST` binding is currently supported * nuclei has to be invoked individually for each target (for each entity ID) * only SPs which accept unsolicited logins (IdP-initiated) can be tested +* headless browser test behaves differently than raw HTTP test (nuclei limitation) diff --git a/nuclei-templates/saml-headless-all.yaml b/nuclei-templates/saml-headless-all.yaml index 57a5d03a529c16efe0746b54b8d935437c0e163e..d770e41d66689e8da0b090fe9ec0ff1150864abf 100644 --- a/nuclei-templates/saml-headless-all.yaml +++ b/nuclei-templates/saml-headless-all.yaml @@ -5,7 +5,7 @@ info: severity: high tags: saml,headless variables: - AUTHORIZATION: "Bearer abcd...789" + BEARER_TOKEN: "abcd...789" CONFORMANCE_IDP_BASE_URL: https://conformance-idp.maiv1.incubator.geant.org/ SCREENSHOTS_DIR: "" FILENAME: '{{date_time("%Y-%M-%D_%H-%m-%s")}}-{{replace_regex(BaseURL,"(\\W+)","_")}}' @@ -28,7 +28,7 @@ headless: args: part: request key: Authorization - value: "{{AUTHORIZATION}}" + value: "Bearer {{BEARER_TOKEN}}" - action: navigate args: url: "{{trim_suffix(CONFORMANCE_IDP_BASE_URL, '/')}}/module.php/conformance/test/setup?testId={{url_encode(TEST_CASE)}}&spEntityId={{url_encode(SP_ENTITY_ID)}}" diff --git a/nuclei-templates/saml-raw-all.yaml b/nuclei-templates/saml-raw-all.yaml index 892d267ce67876b83e1f469ea67942ab3957ff92..0fc049f842956c288c38e73cb5d09afd2b8dfdf5 100644 --- a/nuclei-templates/saml-raw-all.yaml +++ b/nuclei-templates/saml-raw-all.yaml @@ -5,7 +5,6 @@ info: severity: high tags: saml,raw variables: - AUTHORIZATION: "Bearer abcd...789" CONFORMANCE_IDP_BASE_URL: https://conformance-idp.maiv1.incubator.geant.org/ CONFORMANCE_IDP_HOSTNAME: '{{replace_regex(CONFORMANCE_IDP_BASE_URL, "^https?://|/.*$", "")}}' TEST_CASES: @@ -33,13 +32,11 @@ http: @Host: https://{{CONFORMANCE_IDP_HOSTNAME}} POST /module.php/conformance/test/setup?testId={{url_encode(TEST_CASE)}}&spEntityId={{url_encode(SP_ENTITY_ID)}} HTTP/1.1 Host: {{CONFORMANCE_IDP_HOSTNAME}} - Authorization: {{AUTHORIZATION}} - | @Host: https://{{CONFORMANCE_IDP_HOSTNAME}} GET /saml2/idp/SSOService.php?spentityid={{url_encode(SP_ENTITY_ID)}}&ConsumerURL={{url_encode(BaseURL)}} HTTP/1.1 Host: {{CONFORMANCE_IDP_HOSTNAME}} - Authorization: {{AUTHORIZATION}} disable-path-automerge: true extractors: - type: xpath diff --git a/secret-file.example.yaml b/secret-file.example.yaml new file mode 100644 index 0000000000000000000000000000000000000000..e4ec360fc729844ccc97c030c16904d9d69ff62f --- /dev/null +++ b/secret-file.example.yaml @@ -0,0 +1,5 @@ +static: + - type: bearertoken + domains: + - conformance-idp.maiv1.incubator.geant.org + token: abcd...789