OWASP Raider: a novel framework for manipulating HTTP processes of persistent sessions
Raider was created to fill a gap in current tooling for pentesting the authentication process. It abstracts the client-server information exchange as a finite state machine. Each step comprises one request with inputs, one response with outputs, arbitrary actions to do on the response, and conditional links to other stages. Thus, a graph-like structure is created. This architecture works not only for authentication purposes but can be used for any HTTP process that needs to keep track of states.
A few years ago, the author had the task of helping developers to build OAuth directly from RFCs, supporting them with security topics and questions. In the beginning, the project ran into some challenges. Early on, we faced the fact that authentication is a stateful process, while HTTP is a stateless protocol.
BurpSuite and ZAProxy were incepted when the web did not have states, so they inherited a stateless architecture. REST APIs became popular some years after those tools were created. They have workarounds like Burpsuite macros and ZAP Zest scripts to pass information between requests, but we found that functionality lacking and too complex to implement.
So the author wrote custom python scripts to pentest this. It worked fine, but doing this makes the scripts usable only on this system. Therefore, the author decided to create a tool that fills that gap.
Raider's configuration is inspired by Emacs. Hylang is used, which is LISP on top of Python. LISP is used because of its "Code is Data, Data is Code" property. It would also allow generating configuration automatically easily in the future. Flexibility is in its DNA, meaning it can be infinitely extended with actual code. Since all configuration is stored in cleartext, reproducing, sharing or modifying attacks becomes easy.
Links to the project:
- Website: https://raiderauth.com/
- Source: https://github.com/OWASP/raider
- Documentation: https://docs.raiderauth.com/en/latest/
- Twitter: @raiderauth
- Mastodon: @raiderauth@infosec.exchange
Additional information
| Live Stream | https://streaming.media.ccc.de/jev22/rtc |
|---|---|
| Type | Vortrag (45min + 15 Q&A) |
| Language | German |
More sessions
| 12/28/22 |
Dunkle Räume, teure Bildschirme, spannende Technik - willkommen in der Radiologie! Erfahrt welche gängigen Möglichkeiten es gibt, Bilder vom Inneren des Körpers zu machen, wie die Verfahren funktionieren und wofür sie geeignet sind.
|
| 12/28/22 |
Echsenmenschen präsentieren ihre Aktionen und teilen Ihre Skills. Taucht mit uns in die faszinierende Welt der Schwurbel. FRÜHERE BOTSCHAFTEN DER REPTILOIDEN AN DIE MENSCHHEIT ⏩ 2020 zur kritischen einführungswoche tu-berlin : https://youtu.be/dpPrUPpm5pI?t=1018 mit einführung in die schwurbologie ⏩ rc3 2020 im //aboutblank berlin: https://media.ccc.de/v/rc3-11498-schwurbeldemos_der_neuen_rechten_und_gegenprotest mit stürmchen auf das parlament ⏩ rc3 2021 in der c-base berlin: ...
|
| 12/29/22 |
This is a presentation trying to explain what trust is - at the concept level as well as some key implementation details - and why it is important - especially in digital communication.
|
| 12/29/22 |
Moderne Prozessoren führen Programme mit beeindruckender Geschwindigkeit aus. Aber wie tun sie das eigentlich? Wir steigen im Rahmen dieses Vortrages vom Level der Hochsprache runter zum Assembler und schauen uns mal an, was ein Prozessorkern eigentlich genau tut, wenn er Maschinenbefehle ausführt. Wir werden dabei lernen, wie Hardwaredesigner über die Jahrzehnte der CPU beigebracht haben, pro Takt meist mehrere Befehle auszuführen und dabei Schwierigkeiten wie langsamen Speicher und ...
|
| 12/29/22 |
The energy consumption of computer systems are of increasing interest. But it is easy to shoot yourself in the foot while measuring your software. In this talk you will learn about different ways of assessing your software's energy demand, basic mistakes in measurements and how to avoid them.
|
| 12/29/22 |
The aim of this talk is to explore public usage of social media and reactions to different hostilities in 2022 utilizing topic modeling and social network analysis.
|
