PAC Custom AUTHENTICATION

Overview

This document describes how Prancer supports different authentication methods, such as formbase, jwt, cookie, oauth, etc., for authenticated pentesting. The document includes steps to set up authentication, an authentication page example, and a sample PAC YAML file. Prancer uses the Web Authentication API, which uses asymmetric (public-key) instead of passwords or SMS texts for registering, authenticating, and second-factor authentication with websites. The PAC YAML file includes settings for a cookie authentication method, such as login and logout URLs, login body templates, and extra headers.

Authentication

The Web Authentication API (also referred to as WebAuthn) uses asymmetric (public-key) instead of passwords or SMS texts for registering, authenticating, and second-factor authentication with websites. This has some benefits:

Protection against phishing: An attacker who creates a fake login website can't login as the user because the signature changes with the origin of the website. Reduced impact of data breaches: Developers don't need to hash the public key, and if an attacker gets access to the public key used to verify the authentication, it can't authenticate because it needs the private key. Invulnerable to password attacks: Some users might reuse passwords, and an attacker may obtain the user's password for another website (e.g. via a data breach). Also, text passwords are much easier to brute-force than a digital signature.

Prancer authenticated pentesting

Prancer tries to support different authentication methods such as formbase,jwt,cookie,oauth and etc. As all applications have authentication to scan all paths, prancer pentest scanner should be authenticated to send request to the APIs and pages that are behind the auth-middleware.

For setting up authentication we need to create scanner at first. here are some steps which is required to be setup before auth configuration.

  • go to pac wizard page
  • select cloud type
  • select collection and connector (scanner will be created in the resources which the selected connector has an access)
  • put application information
  • select existing or new instance to run the pentest
  • define target domain or select from existing resources

In this step you should be able to see authentication page. ../img/pac/authentications/cookie/Auth_screen.png

So after you select cookie az authentication type , you should select keyvault (if you're using aws you need to select secret manager) to find token value as secret and pass it to the pac file. lets take look to the other fields:

Field Sample values Description
Key Vault every key Vault which connecto has access to it we're going to choose key Vault for selecting secrets like user name and password or etc.
Login URL ex: https://sample.com/login In this field should put complete url for lgin, by this field scanner will be able to find where should login request send to.
Logout URL ex: https://sample.com/logout In this field you should put logout url, this field will be exclude from URLs to prevent logging out the scanner user
Login body template ex: {"username":"%username%","password":"%password%"} This field will help scanner to find out which format is valid format for sending request to login url
username select password from keyvault secrets after we choose keyvault or secret manager we need to select username and password. These variables should be select from the keyvault or secret manager secrets
password select password from keyvault secrets after we choose keyvault or secret manager we need to select username and password. These variables should be select from the keyvault or secret manager secrets
LoginIndicator regex string After scanner send request to authentication URL, it will get response and findout if loginIndicator regex compile is success or failed. If success scanner will be understand that authentication was success and it will extract token from authenticatoin response.
Header Cookie can be anything like : sessionID this value will use as parameter of header like the pattern : (Header cookie) = (Session cookie) token;
Session Cookie can be anything like : session or token this value will use as parameter of header like the pattern : (Header cookie) = (Session cookie) token;
Extra headers can be anything in extra headers we're going to put all require session headers like language or other stuffs

so finaly we have authentication page like below : ../img/pac/authentications/cookie/Auth_cookie.png

and finally we're able to see our pac yaml file

Collection: scenario_azure_cspm
ConnectionName: scenario_azure_cspm_connector
CloudType: azure
ApplicatioName: Ctflean cookie Azure
RiskLevel: standard
Compliance:
- CIS
ApplicationType: WebScan
Schedule: onetime
Target: https://ctflearn.com
Scanner:
  Cloud:
    Platform:
      Azure:
        ContainerInstance:
          AfterRun: delete
          NewContainerInstance:
            External:
              SubscriptionId: a6941677-4c37-42fb-960c-dad8f25060a3
              ResourceGp: shahin-test
              Region: westus
              ContainerGroupName: prancer-scanner-group
              ContainerName: prancer-pentest-instance
              ResourceName: prancer-instances
AuthenticationMethod: cookieAuthentication
Authentication:
  Vault:
    Azure:
      KeyVaultName: shahinKeyVault123Test
      SubscriptionID: a6941677-4c37-42fb-960c-dad8f25060a3
      Region: westus
      ResourceGp: shahin-test
  cookieAuth:
    UsernameSecretKey: userCTF
    PasswordSecretKey: passCTF
    LoginUrl: /user/login
    LogoutUrl: /user/logout
    LoginBodyTemplate: identifier={%username%}&password={%password%}
    LoginIndicator: \Q<a href="/user/logout">Logout</a>\E
    cookieHeadername: Cookie
    cookieSessionName: sessionID
    extraFields: name1=value1;name2=value2
# All the addons ID listed on link https://www.zaproxy.org/addons.
AddOns:
#  - accessControl
#  - ascanrulesAlpha