Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for SAML authentication #253

Open
wants to merge 13 commits into
base: master
Choose a base branch
from

Conversation

jwidavid
Copy link

@jwidavid jwidavid commented May 25, 2024

This PR will serve as the base for several other PR's. As they get reviewed and approved, I will merge them into this one once the feature is a functioning MVP.

  • Update gem to identify the SAML redirect
  • Update gem to add SAML flag to follow the redirect and open the browser (or submit via headless browser)
  • Update gem to accept and handle session and cookies
  • Clean up and complete authentication and scan

Testing Instructions

These specific instructions are dependent on being able to build and run the WPScan CLI Scanner locally (rather than through docker).
See: https://github.com/wpscanteam/wpscan

Update wpscan/Gemfile to add:
gem 'cms_scanner', path: '/absolute-path-to-the-scanner/CMSScanner'

You may also need to comment the following line from the wpscan.gemspec:
s.add_dependency 'cms_scanner', '~> 0.13.9'

  • Run the scanner using the new --expect-saml flag
  • To test against a server with SAML authentication you can use http://3.135.88.75/

@jwidavid jwidavid self-assigned this May 25, 2024
@coveralls
Copy link

coveralls commented May 26, 2024

Coverage Status

coverage: 98.84% (-1.1%) from 99.925%
when pulling 9275a62 on add/saml-authentication
into e4f555a on master.

@miguelxpn
Copy link
Contributor

Can't really approve it since it's a draft state, but LGTM, we can probably go forward with the other ones and then merge them into this branch.

Jared and others added 2 commits May 29, 2024 13:53
Add SAML flag to follow the redirect and open the browser
@jwidavid jwidavid marked this pull request as ready for review May 31, 2024 20:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants