keycloak-scanner

Introduction

This scanner scan keycloak for known vulnerabilities.

Installation

pip install --upgrade keycloak-scanner

Example

$ git clone https://github.com/NeuronAddict/keycloak-scanner
$ cd keycloak-scanner
$ docker-compose -f itests/docker-compose.yml up -d
$ python3 itests/wait-docker-compose.py # just wait keycloak to be load # may be you neeed 'pip install waiting'
python3 itests/wait-docker-compose.py           
('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))
...
HTTPConnectionPool(host='localhost', port=8080): Read timed out. (read timeout=1)
HTTPConnectionPool(host='localhost', port=8080): Read timed out. (read timeout=1)
Keycloak seems to be loaded
$ keycloak-scanner http://localhost:8080 --realms master --clients account --username admin --password Pa55w0rd 
$ # http://localhost:8080  # url to test 
$ #--realms master  # realms to scan, check if a realm exists and use this realms to further scans
$ #--clients account  # clients to scan, check if a client exists and use it to further scans
$ #--username admin  # add a username to test the auth process 
$ #--password Pa55w0rd  # password to test a password auth 
[INFO] Start scanner RealmScanner...
[INFO] Find realm master (http://localhost:8080/auth/realms/master)
[INFO] Public key for realm master : MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyF7ytt1AcJaN67GkLKNrPL6ljoTyYMzMFZ/fXmEJw52yvAXCqE2qFM4MH+fRDfzYcougyOIwNHbDqfAmKzKpeYGi+4JSaSmDGpZVuz2aDkncyXh6uA4IanjBai7IhEeWDY6HCcLxkd/ppfNclmfOrEGJGbFoz+QCFiNbWzSr0mAo1S3WmgC13297nK5iunR+eJSqCbg3FXn+8RZcwhNHhKSGV75G4ZnBDLcBcaEUflBWshv2gAErZktT0tdEtXNRpv4vAvp0yEvAKSPVOESpnZW7PFNtBPI/+GlaAWxEC9V58qzhiRTJ+MU3fzwcBMRz4DmptdSN6bDLvkPr5eS9JQIDAQAB
[INFO] Start scanner WellKnownScanner...
[INFO] Find a well known for realm Realm('master', 'http://localhost:8080/auth/realms/master', {'realm': 'master', 'public_key': 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyF7ytt1AcJaN67GkLKNrPL6ljoTyYMzMFZ/fXmEJw52yvAXCqE2qFM4MH+fRDfzYcougyOIwNHbDqfAmKzKpeYGi+4JSaSmDGpZVuz2aDkncyXh6uA4IanjBai7IhEeWDY6HCcLxkd/ppfNclmfOrEGJGbFoz+QCFiNbWzSr0mAo1S3WmgC13297nK5iunR+eJSqCbg3FXn+8RZcwhNHhKSGV75G4ZnBDLcBcaEUflBWshv2gAErZktT0tdEtXNRpv4vAvp0yEvAKSPVOESpnZW7PFNtBPI/+GlaAWxEC9V58qzhiRTJ+MU3fzwcBMRz4DmptdSN6bDLvkPr5eS9JQIDAQAB', 'token-service': 'http://localhost:8080/auth/realms/master/protocol/openid-connect', 'account-service': 'http://localhost:8080/auth/realms/master/account', 'tokens-not-before': 0}) http://localhost:8080/auth/realms/master/.well-known/openid-configuration
[INFO] Start scanner ClientScanner...
[INFO] Find a client for realm master: account
[INFO] Start scanner LoginScanner...
[+] LoginScanner - Form login work for admin on realm master, client account, (http://localhost:8080/auth/realms/master/account?session_state=4c152780-3980-439c-8e9d-15139ee19afa&code=2f821574-34e0-4917-8b00-c87c6fd302b0.4c152780-3980-439c-8e9d-15139ee19afa.3e118dc6-4780-42cf-90e7-abd81c1e7046)
[+] LoginScanner - Form login work for admin on realm master, client account, (http://localhost:8080/auth/realms/master/account?session_state=14a6cbcc-1b76-4b52-aa27-982a06b8c2a1&code=656fc3c9-3ea6-44af-9037-85288f471ab7.14a6cbcc-1b76-4b52-aa27-982a06b8c2a1.3e118dc6-4780-42cf-90e7-abd81c1e7046)
[INFO] Start scanner SecurityConsoleScanner...
[WARN] Result of SecurityConsoleScanner as no results (void list), subsequent scans can be void too.
[INFO] Start scanner OpenRedirectScanner...
[INFO] Start scanner FormPostXssScanner...
[INFO] Start scanner NoneSignScanner...

scan types :

• realm : check if a realm exists
• client : check if a client exists in all realms
• well_known : get well_known for all realms
• login : test login against all clients / realms
• client registration : try to add a new client (WARNING, client is deleted after test, if its not the case, be sure to make it manually)
• OpenRedirect : check if attack authorization flow via open redirection (unvalidated redirect_uri) is possible
• form post : check CVE 2018 14655
• none sign : check if none sign algorithm is supported

Help

$ keycloak-scanner --help
usage: keycloak-scanner [-h] --realms REALMS --clients CLIENTS [--proxy PROXY]

                        [--username USERNAME] [--password PASSWORD]

                        [--ssl-noverify] [--verbose] [--no-fail] [--fail-fast]

                        [--version]

                        (--registration-callback REGISTRATION_CALLBACK | --registration-callback-list REGISTRATION_CALLBACK_LIST)

                        base_url

KeyCloak vulnerabilities scanner.

positional arguments:

  base_url              URL to scan. ex http://localhost:8080

optional arguments:

  -h, --help            show this help message and exit

  --realms REALMS       Comma separated list of custom realms to test. ie :

                        master

  --clients CLIENTS     Comma separated list of custom clients to test. On

                        default installation, use account,admin-

                        cli,broker,realm-management,security-admin-console

  --proxy PROXY         Use a great proxy like BURP ;)

  --username USERNAME   If a username is specified, try to connect and attack

                        a token. If no password, try username as password.

  --password PASSWORD   password to test with username

  --ssl-noverify        Do not verify ssl certificates

  --verbose             Verbose mode

  --no-fail             Always exit with code 0 (by default, fail with an exit

                        code 4 if a vulnerability is discovered or 8 if an

                        error occur). Do NOT fail before all test are done.

  --fail-fast           Fail immediately if an error occur.

  --version             show program's version number and exit

  --registration-callback REGISTRATION_CALLBACK

                        Callback url to use on client registration test

  --registration-callback-list REGISTRATION_CALLBACK_LIST

                        File with one callback to test for registration by

                        line

Scans : 

- list realms

- Search well-known files

- Search for clients

- Search for valid logins

- Try client registration

- Search for security-admin-console and secret inside

- Search for open redirect via unvalidated redirect_uri

- Search for CVE-2018-14655 (reflected XSS)

- None alg in refresh token

Bugs, feature requests, request another scan, questions : https://github.com/NeuronAddict/keycloak-scanner.

*** Use it on production systems at your own risk ***

Install with source code

With venv:

cd keycloak-scanner
python3 -m venv venv
source venv/bin/activate
pip install -e . # with -e, git pull will update code
keycloak-scanner

Or without venv :

cd keycloak-scanner
sudo pip3 install . # use sudo for install for all users
keycloak-scanner

TODO

• password dictionary support
• Scanner details via command line