apiborker.py

#!/usr/bin/env python

"""
A tool to test API endpoints: Can grab OAuth2 codes, tokens and cookies,
and brute-force API endpoints with optional payloads.

Copyright (C) 2016 Peter Mosmans [Radically Open Security]

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
"""

from __future__ import absolute_import
from __future__ import print_function

import argparse
import base64
import re
import sys
import textwrap
import urlparse

try:
    import jwt
    import requests
except ImportError:
    print('[-] This script needs the jwt and requests library', file=sys.stderr)
    sys.exit(-1)


VERSION = 0.12


def adfs_login(options):
    """
    Logs in on an ADFS server using options['username'] and options['password']
    """
    if not options['username'] or not options['password']:
        print_error("""This command needs --adfs-login, --username and
                    --password""", -1)
    variables = dict(payload={'UserName': options['username'],
                              'Password': options['password'],
                              'AuthMethod': 'FormsAuthentication'},
                     params={'client_id': options['client_id'],
                             'redirect_uri': options['redirect_uri'],
                             'response_type': 'code',
                             'resource': options['resource']})
    request = do_request(options['adfs_login'], 'POST', variables, options)
    if request.status_code == 302:
        print_line('[+] Successfully logged in')
        cookie = request.cookies['MSISAuth']
        print_line(cookie)
        return cookie
    else:
        print_line('[-] Could not log in')
        return None


def call_api(url, bearer, parameter, options):
    """
    Calls an API endpoint using authorization header.
    @parameter: When TRUE, parameterizes request.
    """
    result = True
    if not urlparse.urlparse(url).scheme:
        url = 'https://{0}'.format(url)
    variables = dict(headers={'apiborker': VERSION,
                              'Accept': 'application/json'})
    if bearer:
        variables['headers']['Authorization'] = 'Bearer ' + bearer
    if parameter:
        print_line('[+] Parameterizing request (adding a suffix)')
        url = url + '42'
    for method in ['GET', 'POST', 'PUT', 'DELETE']:
        if method == 'POST' and options['payload']:
            variables['payload'] = options['payload']
        request = do_request(url, method, variables, options)
        if request is not None:
            print_line('received status code {0}'.format(request.status_code))
            if request.status_code == 401:
                print_error('Giving up, received 401 unauthorized')
                result = False
        else:
            print_error('hmmz', True)
    return result


def do_request(url, method, variables, options):
    """
    Wrapper around the request object.
    Performs HTTP @method on @uri using @variables.
    """
    print_line('[+] performing {0} on {1}'.format(method, url))
#    proxies = {}
    proxies = {'http': 'http://127.0.0.1:8080',
               'https': 'https://127.0.0.1:8080'}
    # Don't try this at home, kids! Disabling SSL verification
    verify = False
    if not verify:
        requests.packages.urllib3.disable_warnings(
            requests.packages.urllib3.exceptions.InsecureRequestWarning)
    try:
        if method == 'DELETE':
            request = requests.delete(url,
                                      allow_redirects=variables.get('allow_redirects'),
                                      cookies=variables.get('cookies'),
                                      data=variables.get('payload'),
                                      headers=variables.get('headers'),
                                      params=variables.get('params'),
                                      proxies=proxies, verify=verify)
        if method == 'GET':
            request = requests.get(url,
                                   allow_redirects=variables.get('allow_redirects'),
                                   cookies=variables.get('cookies'),
                                   data=variables.get('payload'),
                                   headers=variables.get('headers'),
                                   params=variables.get('params'),
                                   proxies=proxies, verify=verify)
        if method == 'POST':
            request = requests.post(url,
                                    allow_redirects=variables.get('allow_redirects'),
                                    cookies=variables.get('cookies'),
                                    data=variables.get('payload'),
                                    headers=variables.get('headers'),
                                    params=variables.get('params'),
                                    proxies=proxies, verify=verify)
        if method == 'PUT':
            request = requests.put(url,
                                   allow_redirects=variables.get('allow_redirects'),
                                   cookies=variables.get('cookies'),
                                   data=variables.get('payload'),
                                   headers=variables.get('headers'),
                                   params=variables.get('params'),
                                   proxies=proxies, verify=verify)
    except requests.exceptions.ConnectionError:
        print_error('Could not connect to {0}'.format(url), -1)
        return None
    except requests.exceptions.MissingSchema:
        print_error('The schema seems to be missing for {0}'.format(url), -1)
        return None
    print_status(request.headers, options)
    return request


def extract_tokens(token):
    """
    Extracts multiple tokens from a base64 encoded string.
    """
    try:
        # Add some soft padding to make sure the token always decodes
        splittoken = re.split('[:\'\"]', base64.b64decode(token + '==='))
        proxy_token = splittoken[4]
        access_token = splittoken[9]
    except IndexError:
        print_error('Unknown token format', -1)
    return proxy_token, access_token


def get_code(options):
    """
    Retrieves an authorization code using an ADFS cookie.
    """
    if not options['cookie']:
        print_error('This command needs a valid --cookie', -1)
    variables = dict(cookies={'MSISAuth': options['cookie']},
                     params={'client_id': options['client_id'],
                             'redirect_uri': options['redirect_uri'],
                             'response_type': 'code',
                             'resource': options['resource']})
    request = do_request(options['adfs_code'], 'GET', variables, options)
    if request.status_code == 302:
        code = request.headers['Location'].split('code=')[1]
        print_line('[+] Successfully retrieved authorization code')
        print_line(code)
        return code
    else:
        print_error('Could not retrieve authorization code', -1)


def get_token(options):
    """
    Retrieves a JWT token using an authorization code.
    """
    if not options['cookie'] or not options['code']:
        print_error('This command needs a valid --cookie and --code', -1)
    variables = dict(cookies={'MSISAuth': options['cookie']},
                     payload={'grant_type': 'authorization_code',
                              'client_id': options['client_id'],
                              'redirect_uri': options['redirect_uri'],
                              'code': options['code']})
    request = do_request(options['adfs_token'], 'POST', variables, options)
    if request.status_code == 200:
        print_line('[+] Successfully retrieved authorization token')
        token = str(request.json()['access_token'])
        print_line(token)
        return token
    else:
        print_error('Could not retrieve authorization token', -1)


def parse_arguments():
    """
    Parses command line arguments, exits on invalid values.
    """
    parser = argparse.ArgumentParser(
        formatter_class=argparse.RawDescriptionHelpFormatter,
        description=textwrap.dedent('''\
Executes API calls based on a list of inputs.

Copyright (C) 2016 Peter Mosmans [Go Forward]
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.'''))
    parser.add_argument('--adfs-code', action='store',
                        help='the authorization code URL')
    parser.add_argument('--adfs-token', action='store',
                        help='the authorization token URL')
    parser.add_argument('--adfs-login', action='store',
                        help='the ADFS login URL')
    parser.add_argument('--client-id', action='store',
                        help='the client ID for ADFS')
    parser.add_argument('--clipboard', action='store_true',
                        help='copy the token as header to the clipboard')
    parser.add_argument('--code', action='store',
                        help='the authorization code')
    parser.add_argument('--cookie', action='store',
                        help='a valid ADFS (MSISauth) login cookie')
    parser.add_argument('-i', '--inputfile', action='store',
                        help='a file containing API endpoints')
    parser.add_argument('--password', action='store',
                        help='the password for login')
    parser.add_argument('--payload', action='store',
                        help='the payload to send for POST requests')
    parser.add_argument('--redirect-uri', action='store',
                        help='the redirect URI for ADFS')
    parser.add_argument('--resource', action='store',
                        help='the resource to request access to')
    parser.add_argument('-t', '--token', action='store',
                        help='the complete token in base64 encoded format')
    parser.add_argument('-u', '--url', action='store',
                        help='the base URL for requests')
    parser.add_argument('--username', action='store',
                        help='the username for login')
    parser.add_argument('-v', '--verbose', action='store_true',
                        help='be more verbose')
    if len(sys.argv) == 1:
        parser.print_help()
    return vars(parser.parse_args())


def print_error(text, result=False):
    """
    Prints error message.
    When @result, exits with result.
    """
    if len(text):
        print_line('[-] ' + text, True)
    if result:
        sys.exit(result)


def print_line(text, error=False):
    """
    Prints text, and flushes stdout and stdin.
    When @error, prints text to stderr instead of stdout.
    """
    if not error:
        print(text)
    else:
        print(text, file=sys.stderr)
    sys.stdout.flush()
    sys.stderr.flush()


def print_status(text, options=False):
    """
    Prints status message if options array is given and contains 'verbose'.
    """
    if options and options['verbose']:
        print_line('[*] ' + str(text))


def read_endpoints(filename):
    """
    Returns a list of endpoints.
    """
    endpoints = []
    try:
        with open(filename, 'r') as readfile:
            endpoints = readfile.read().splitlines()
    except IOError:
        print_error('could not read {0}'.format(filename), True)
    return endpoints


def main():
    """
    The main loop.
    """
    options = parse_arguments()
    if options['clipboard']:
        try:
            import pyperclip
        except ImportError:
            print_error('The pyperclip module is needed to use the clipboard.')
            options['clipboard'] = False
    if options['adfs_login']:
        options['cookie'] = adfs_login(options)
    if options['adfs_code']:
        options['code'] = get_code(options)
    if options['adfs_token']:
        options['token'] = get_token(options)
    if options['token']:
        if options['clipboard']:
            pyperclip.copy('Authorization: Bearer ' + options['token'])
            print_status('Token and header copied to clipboard')
        proxy_token, access_token = extract_tokens(options['token'])
        print_status('proxy token: {0}\nclaims: {1}'.
                     format(jwt.process_jwt(proxy_token)[0],
                            jwt.process_jwt(proxy_token)[1]), options)
        print_status('access token: {0}\nclaims: {1}'.
                     format(jwt.process_jwt(access_token)[0],
                            jwt.process_jwt(access_token)[1]), options)
    if options['inputfile']:
        endpoints = read_endpoints(options['inputfile'])
        for endpoint in endpoints:
            # expecting URI[{value}]
            line = re.split('[{}]', endpoint)
            call_api(line[0], options['token'], len(line) > 1, options)


if __name__ == "__main__":
    main()