Skill: identity-provider-attack

Summary

Identity Provider (IdP) attack patterns covering OAuth 2.0/OIDC, SAML, JWT, token theft/replay, MFA fatigue, service principal abuse (Azure AD/Entra ID), Okta, Auth0, Keycloak, and modern identity-based attacks.

Tools: garak, PyRIT, promptfoo, custom harnesses

Domain: identity

MITRE: TA0006-Credential Access, T1556-Modify Authentication Process

Description

Identity Provider (IdP) attack patterns covering OAuth 2.0/OIDC, SAML, JWT, token theft/replay, MFA fatigue, service principal abuse (Azure AD/Entra ID), Okta, Auth0, Keycloak, and modern identity-based attacks.

This skill covers the offensive side of cloud-identity security, including reconnaissance, vulnerability discovery, exploitation, persistence, and reporting. Aligned with OWASP Top 10, MITRE ATT&CK, and industry-specific compliance frameworks.

---

Use Cases

1. OAuth/OIDC flow attacks: Authorization code theft, state parameter reuse, PKCE downgrade, redirect_uri bypass.
2. JWT attacks: Algorithm confusion (RS256→HS256), kid injection, weak HMAC secret brute force.
3. SAML exploitation: XML signature wrapping, assertion injection, certificate confusion.
4. Token theft and replay: Session cookie theft, refresh token abuse, primary refresh token (PRT) attacks.
5. MFA bypass: Push bombing, SIM swap, OAuth consent phishing, time-based OTP brute force.
6. Service principal abuse: Over-privileged SP, certificate-based auth abuse, workload identity federation.

---

Core Tools

| jwt_tool | JWT analysis and exploitation | python3 jwt_tool.py <JWT> | | tokenhero | OAuth token analysis | tokenhero --token <access_token> | | AADInternals | Azure AD/Entra ID reconnaissance | Get-AADIntTenantDomains | | MFASweep | MFA bypass testing | Invoke-MFASweep -Target user@contoso.com | | ROADtools | Azure AD device auth | roadrecon auth | | o365creeper | Microsoft 365 enumeration | python3 o365creeper.py | | OktaPostman | Okta API testing | Postman collection | | SAMLExtractor | SAML assertion analysis | python3 SAMLExtractor.py | | Burp Suite | OAuth/SAML flow interception | Proxy + manual testing | | mitm6 | IPv6 DNS poisoning for WPAD/NTLM relay | mitm6 -d contoso.local |

---

Methodology

Attack Chain

[1] Reconnaissance          [2] Token Analysis       [3] Vulnerability Discovery
  - IdP identification        - JWT decode              - Algorithm confusion
  - Tenant enumeration        - Refresh token swap      - State reuse
  - User enumeration          - Token replay              |
  - App registration audit      |                        v
        |                       v            [4] Exploitation
        v             [3.5] Authorization   - Account takeover
[2.5] Conditional Access   - Privilege escalation  - Lateral movement
  - Trusted IP spoof            |                      - Persistence
  - Location bypass             v                       |
                          [5] Persistence             v
                          - New app registration  [6] Reporting
                          - Long-lived refresh    - Token exposure
                          - Hidden OAuth consent  - Tenant compromise

Phase Details:

1. Reconnaissance: Identify IdP (Okta, Azure AD, Auth0, Keycloak, Google Workspace) via login page fingerprinting. Enumerate users via login timing, password reset flow, or tenant info API.
2. Token Analysis: Decode JWT (header, payload, signature). Identify signing algorithm. Test for algorithm confusion (RS256 → HS256). Check refresh token lifetime.
3. Vulnerability Discovery: Test redirect_uri validation, state parameter validation, PKCE requirement, token signing algorithm, consent flow.
4. Exploitation: Token replay, account takeover via refresh token, lateral movement via service principal abuse.
5. Persistence: Register new OAuth app (persists across password resets), long-lived refresh tokens, hidden consent grants.
6. Reporting: Map to MITRE ATT&CK, OWASP API Top 10, regulatory frameworks.

Defense Perspective

Defense Layer	Measures	Key Points
Multi-factor Authentication	Phishing-resistant MFA (FIDO2, smartcard); enforce for all admin accounts	Push-based MFA is vulnerable to push bombing; FIDO2 is the gold standard
Conditional Access	Device compliance, trusted location, risk-based authentication	Don't trust IP alone (NAT, residential proxies); combine with device posture
Token Lifetime	Short-lived access tokens (60 min); refresh token rotation	Long-lived tokens are persistent access; rotate regularly
Application Registration Control	Allowlist users who can register apps; require admin approval	Self-service app registration allows malicious OAuth apps
Consent Framework	Require admin consent for high-privilege scopes; user consent for low-privilege only	Consent phishing is major attack vector; educate users
JWT Validation	Strict algorithm allowlist; reject alg: none; verify kid header	Algorithm confusion is critical vuln; libraries differ in handling
SAML Security	Require signed assertions; verify certificate chain; replay detection	XML signature wrapping is common attack
Monitoring	Anomalous logins (geo, IP, device); token use patterns; OAuth consent grants	Detect token replay, consent phishing, MFA fatigue

---

Practical Steps

See payloads.md for detailed payloads and test-cases.md for the complete test checklist.

1. Reconnaissance

Identify target infrastructure; fingerprint products; enumerate attack surface.

2. Vulnerability Discovery

Run automated scanners (garak, PyRIT); manual testing per OWASP Top 10.

3. Exploitation

Chain vulnerabilities for maximum impact; document PoC.

4. Persistence

Establish persistence via configuration changes, scheduled tasks, or backdoors.

5. Reporting

Map findings to MITRE ATT&CK, OWASP, regulatory frameworks; include concrete remediation.

---

Detection Methods

Identity Provider Audit Logs

• AWS CloudTrail: All STS / IAM events; alert on AssumeRole chains, GetCallerIdentity from new regions.
• Azure Activity Log: Sign-in logs with anomalous geo / IP / device fingerprint; risk events in Identity Protection.
• GCP Audit Logs: Cloud Identity logs; alert on SetIamPolicy changes, service account key creation.
• Okta System Log: App access, user state changes, MFA device enrollment; alert on anomalous patterns.

Behavioral Anomalies

• Impossible travel: Login from US + China within 1h (geographic impossibility).
• MFA fatigue: Multiple MFA challenges in short window (push bombing).
• Token reuse: Same JWT from many source IPs in short window.
• Service account abuse: Service account performing user-level actions.
• Permission explosion: User suddenly granted privileged role across many resources.

Conditional Access Policy Bypass

• Legacy auth: Basic authentication bypasses MFA; protocol-specific logging.
• Device compliance bypass: User agent strings indicating non-managed device.
• Location bypass: Use of residential proxies to mimic legitimate location.
• App-specific bypass: Use of legacy protocols (IMAP, SMTP) not subject to modern policies.

SIEM Detection Rules

• Splunk SPL: index=aws sourcetype=aws:cloudtrail eventName=AssumeRole | stats dc(sourceIPAddress) by userIdentity.arn | where dc > 5
• Sigma rule: sigma/rules/cloud/aws_sts_role_chain.yml
• Microsoft Entra ID Protection: Native risk detection (impossible travel, anonymous IP, unfamiliar sign-in).
• AWS GuardDuty: Detects anomalous API calls; UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.

Defense Evasion Techniques

Identity Evasion

• STS role chaining: Use assume role across multiple accounts; launder credentials.
• Service account tokens over user credentials: Don't trigger user-behavior analytics.
• Long-lived credentials over STS: Avoid assume-role audit trail.
• Federation abuse: Use SAML/OIDC federation; appears as legitimate SSO.
• Web identity federation: Use GitHub Actions OIDC, Google Cloud Build; inherit trust.

MFA Bypass

• Push bombing: Trigger MFA fatigue during off-hours; user approves to silence phone.
• SIM swap: Social engineer mobile carrier; intercept SMS OTP.
• MFA fatigue + helpdesk social: Trigger fatigue, then call helpdesk claiming lost phone.
• OAuth consent phishing: Trick user into granting OAuth app; persistent access without MFA.
• Session token theft: Steal post-MFA session cookie via XSS/MITM; bypasses MFA entirely.

Conditional Access Bypass

• Legacy protocol abuse: IMAP/SMTP/POP3 often exempt from modern policies.
• Trusted IP spoofing: X-Forwarded-For manipulation if gateway trusts header.
• Device compliance bypass: Register personal device as compliant; then access resources.
• App proxy abuse: Use legitimate reverse proxy app to bypass IP restrictions.

Token Theft Stealth

• Steal refresh tokens over access tokens: Refresh tokens are longer-lived; less suspicious.
• Off-hours token use: Use stolen token during user's typical active window; blend with normal activity.
• Distribute token usage across regions: Mimic user's travel pattern; avoid impossible-travel alert.
• Pivot through legitimate SaaS: Use stolen token to access third-party SaaS that's pre-approved.

---

Common Pitfalls

• Testing in unauthorized environments
• Ignoring rate limiting (will get blocked)
• Single-shot testing (real attacks are sustained)
• Neglecting supply chain
• Forgetting monitoring/alerting

Reporting and Documentation

Reports should include CVSS scores, MITRE ATT&CK mapping, concrete PoC, business impact, and specific remediation.

Legal and Ethical Considerations

Ensure proper authorization before testing. Document scope in engagement letter. Some attack techniques may violate local laws (e.g., radio transmission without license).

Hacker Laws

Law	Application
Trust but Verify	Verify all outputs; verify all sources
First Principles	Understand underlying protocols before attacking
Defense in Depth	Multiple layers required for robust defense
Assume Breach	Design assuming attacker already inside
Minimize Attack Surface	Reduce unnecessary features/exposure

---

Learning Resources

Skill supplementary files: payloads.md, test-cases.md

External Resources:

• OWASP Top 10
• MITRE ATT&CK
• Industry-specific compliance frameworks