identity-provider-attack

Skill: identity-provider-attack

Summary

Identity Provider (IdP) attack patterns covering OAuth 2.0/OIDC, SAML, JWT, token theft/replay, MFA fatigue, service principal abuse (Azure AD/Entra ID), Okta, Auth0, Keycloak, and modern identity-based attacks.

Tools: garak, PyRIT, promptfoo, custom harnesses

Domain: identity

MITRE: TA0006-Credential Access, T1556-Modify Authentication Process

Description

Identity Provider (IdP) attack patterns covering OAuth 2.0/OIDC, SAML, JWT, token theft/replay, MFA fatigue, service principal abuse (Azure AD/Entra ID), Okta, Auth0, Keycloak, and modern identity-based attacks.

This skill covers the offensive side of cloud-identity security, including reconnaissance, vulnerability discovery, exploitation, persistence, and reporting. Aligned with OWASP Top 10, MITRE ATT&CK, and industry-specific compliance frameworks.

Use Cases

1. OAuth/OIDC flow attacks: Authorization code theft, state parameter reuse, PKCE downgrade, redirect_uri bypass.
2. JWT attacks: Algorithm confusion (RS256→HS256), kid injection, weak HMAC secret brute force.
3. SAML exploitation: XML signature wrapping, assertion injection, certificate confusion.
4. Token theft and replay: Session cookie theft, refresh token abuse, primary refresh token (PRT) attacks.
5. MFA bypass: Push bombing, SIM swap, OAuth consent phishing, time-based OTP brute force.
6. Service principal abuse: Over-privileged SP, certificate-based auth abuse, workload identity federation.

Core Tools

| jwt_tool | JWT analysis and exploitation | python3 jwt_tool.py <JWT> | | tokenhero | OAuth token analysis | tokenhero --token <access_token> | | AADInternals | Azure AD/Entra ID reconnaissance | Get-AADIntTenantDomains | | MFASweep | MFA bypass testing | Invoke-MFASweep -Target [email protected] | | ROADtools | Azure AD device auth | roadrecon auth | | o365creeper | Microsoft 365 enumeration | python3 o365creeper.py | | OktaPostman | Okta API testing | Postman collection | | SAMLExtractor | SAML assertion analysis | python3 SAMLExtractor.py | | Burp Suite | OAuth/SAML flow interception | Proxy + manual testing | | mitm6 | IPv6 DNS poisoning for WPAD/NTLM relay | mitm6 -d contoso.local |

Methodology

Attack Chain

[1] Reconnaissance          [2] Token Analysis       [3] Vulnerability Discovery
  - IdP identification        - JWT decode              - Algorithm confusion
  - Tenant enumeration        - Refresh token swap      - State reuse
  - User enumeration          - Token replay              |
  - App registration audit      |                        v
        |                       v            [4] Exploitation
        v             [3.5] Authorization   - Account takeover
[2.5] Conditional Access   - Privilege escalation  - Lateral movement
  - Trusted IP spoof            |                      - Persistence
  - Location bypass             v                       |
                          [5] Persistence             v
                          - New app registration  [6] Reporting
                          - Long-lived refresh    - Token exposure
                          - Hidden OAuth consent  - Tenant compromise

Phase Details:

1. Reconnaissance: Identify IdP (Okta, Azure AD, Auth0, Keycloak, Google Workspace) via login page fingerprinting. Enumerate users via login timing, password reset flow, or tenant info API.
2. Token Analysis: Decode JWT (header, payload, signature). Identify signing algorithm. Test for algorithm confusion (RS256 → HS256). Check refresh token lifetime.
3. Vulnerability Discovery: Test redirect_uri validation, state parameter validation, PKCE requirement, token signing algorithm, consent flow.
4. Exploitation: Token replay, account takeover via refresh token, lateral movement via service principal abuse.
5. Persistence: Register new OAuth app (persists across password resets), long-lived refresh tokens, hidden consent grants.
6. Reporting: Map to MITRE ATT&CK, OWASP API Top 10, regulatory frameworks.

Defense Perspective

Practical Steps

See payloads.md for detailed payloads and test-cases.md for the complete test checklist.

1. Reconnaissance

Identify target infrastructure; fingerprint products; enumerate attack surface.

2. Vulnerability Discovery

Run automated scanners (garak, PyRIT); manual testing per OWASP Top 10.

3. Exploitation

Chain vulnerabilities for maximum impact; document PoC.

4. Persistence

Establish persistence via configuration changes, scheduled tasks, or backdoors.

5. Reporting

Map findings to MITRE ATT&CK, OWASP, regulatory frameworks; include concrete remediation.

Detection Methods

Identity Provider Audit Logs

• AWS CloudTrail: All STS / IAM events; alert on AssumeRole chains, GetCallerIdentity from new regions.
• Azure Activity Log: Sign-in logs with anomalous geo / IP / device fingerprint; risk events in Identity Protection.
• GCP Audit Logs: Cloud Identity logs; alert on SetIamPolicy changes, service account key creation.
• Okta System Log: App access, user state changes, MFA device enrollment; alert on anomalous patterns.

Behavioral Anomalies

• Impossible travel: Login from US + China within 1h (geographic impossibility).
• MFA fatigue: Multiple MFA challenges in short window (push bombing).
• Token reuse: Same JWT from many source IPs in short window.
• Service account abuse: Service account performing user-level actions.
• Permission explosion: User suddenly granted privileged role across many resources.

Conditional Access Policy Bypass

• Legacy auth: Basic authentication bypasses MFA; protocol-specific logging.
• Device compliance bypass: User agent strings indicating non-managed device.
• Location bypass: Use of residential proxies to mimic legitimate location.
• App-specific bypass: Use of legacy protocols (IMAP, SMTP) not subject to modern policies.

SIEM Detection Rules

• Splunk SPL: index=aws sourcetype=aws:cloudtrail eventName=AssumeRole | stats dc(sourceIPAddress) by userIdentity.arn | where dc > 5
• Sigma rule: sigma/rules/cloud/aws_sts_role_chain.yml
• Microsoft Entra ID Protection: Native risk detection (impossible travel, anonymous IP, unfamiliar sign-in).
• AWS GuardDuty: Detects anomalous API calls; UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.

Defense Evasion Techniques

Identity Evasion

• STS role chaining: Use assume role across multiple accounts; launder credentials.
• Service account tokens over user credentials: Don't trigger user-behavior analytics.
• Long-lived credentials over STS: Avoid assume-role audit trail.
• Federation abuse: Use SAML/OIDC federation; appears as legitimate SSO.
• Web identity federation: Use GitHub Actions OIDC, Google Cloud Build; inherit trust.

MFA Bypass

• Push bombing: Trigger MFA fatigue during off-hours; user approves to silence phone.
• SIM swap: Social engineer mobile carrier; intercept SMS OTP.
• MFA fatigue + helpdesk social: Trigger fatigue, then call helpdesk claiming lost phone.
• OAuth consent phishing: Trick user into granting OAuth app; persistent access without MFA.
• Session token theft: Steal post-MFA session cookie via XSS/MITM; bypasses MFA entirely.

Conditional Access Bypass

• Legacy protocol abuse: IMAP/SMTP/POP3 often exempt from modern policies.
• Trusted IP spoofing: X-Forwarded-For manipulation if gateway trusts header.
• Device compliance bypass: Register personal device as compliant; then access resources.
• App proxy abuse: Use legitimate reverse proxy app to bypass IP restrictions.

Token Theft Stealth

• Steal refresh tokens over access tokens: Refresh tokens are longer-lived; less suspicious.
• Off-hours token use: Use stolen token during user's typical active window; blend with normal activity.
• Distribute token usage across regions: Mimic user's travel pattern; avoid impossible-travel alert.
• Pivot through legitimate SaaS: Use stolen token to access third-party SaaS that's pre-approved.

Common Pitfalls

• Testing in unauthorized environments
• Ignoring rate limiting (will get blocked)
• Single-shot testing (real attacks are sustained)
• Neglecting supply chain
• Forgetting monitoring/alerting

Reporting and Documentation

Reports should include CVSS scores, MITRE ATT&CK mapping, concrete PoC, business impact, and specific remediation.

Legal and Ethical Considerations

Ensure proper authorization before testing. Document scope in engagement letter. Some attack techniques may violate local laws (e.g., radio transmission without license).

Hacker Laws

Learning Resources

Skill supplementary files: payloads.md, test-cases.md

External Resources:

• OWASP Top 10
• MITRE ATT&CK
• Industry-specific compliance frameworks