AuthProbe
How It Works
⚠️ Authorized Testing Only
This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.
AuthProbe is an authentication detection and probing tool that analyzes a target URL to identify the authentication methods in use and optionally validates credentials against each detected method. It operates entirely in Python using the requests library — no external binaries or subprocess calls are required.
When pointed at a target, AuthProbe performs a series of HTTP requests to detect authentication mechanisms: it checks response headers for WWW-Authenticate challenges (Basic, Digest, NTLM, Negotiate/Kerberos), inspects HTML forms for login fields, probes well-known authentication endpoints (OAuth token URLs, SAML metadata, OpenID Connect discovery), and fingerprints the underlying software platform using the SOFTWARE_FINGERPRINTS pattern database. The fingerprinting engine matches response headers, HTML content, cookies, and URL patterns against known signatures for platforms like WordPress, Drupal, Joomla, Microsoft 365, Okta, Keycloak, FortiGate, Palo Alto, Cisco, and dozens more.
When credentials are provided via --username and --password, AuthProbe attempts to validate them against each detected authentication method, reporting whether the credentials were accepted. This is particularly useful after AuthProbe has been run in discovery mode to identify what authentication methods are available, enabling the tester to target the most promising vector.
AuthProbe integrates with the Crucible management platform via protocol tokens (__CRUCIBLE_LOG__, __CRUCIBLE_STATUS__, __CRUCIBLE_ERR__) when running under CRUCIBLE_MANAGED=1. Its output feeds directly into Fracture and Siphon's authentication configuration, helping those tools authenticate to the target application for deeper testing phases.
Phase Pipeline
- Phase 1 — Target Connection
- Phase 2 — Technology Fingerprinting
- Phase 3 — Authentication Probing
- Phase 4 — Results Reporting
Security
CLI tool. Credentials passed via command-line arguments for authentication testing. Rendered mode (--rendered) launches a headless browser with a temporary profile that is cleaned up after the session.
Features
Authentication
Authentication Detection
Credential Validation
Detection
Integration
Software Fingerprinting
Use Cases
Pre-Test Authentication Discovery
Before configuring Fracture or Siphon for authenticated testing, run AuthProbe against the target to automatically detect all available authentication methods, reducing manual reconnaissance effort and ensuring no auth vectors are overlooked.
Multi-Application Auth Inventory
During a large engagement with dozens of web applications, AuthProbe rapidly inventories the authentication methods across all targets, identifying which use SSO, which have local login forms, and which expose API authentication endpoints.
Portal Platform Identification
AuthProbe's software fingerprinting identifies the underlying platform (e.g., Okta, Keycloak, FortiGate admin panel), which guides the tester toward platform-specific attack techniques and known vulnerabilities.
Credential Validation
After obtaining credentials through other means (breach data, social engineering, password spraying), AuthProbe validates them against detected authentication methods to confirm which credentials are active and which auth vectors they work against.
CLI Reference
Command Examples
Probe URL
Detect authentication methods on a URL.
JSON Output
Structured JSON output for tool integration.
With Credentials
Probe with credentials to test if they work.
Rendered Mode
Use headless browser for JavaScript-rendered login pages.
Finding Nomenclature
AuthProbe findings identify detected authentication methods and weaknesses — e.g., HTTP Basic Auth without TLS, form login without CSRF protection, missing account lockout, session cookies without Secure/HttpOnly flags.
Action Items
AuthProbe generates action items for detected auth mechanisms — e.g., "Configure Fracture with detected form login fields", "Test bearer token endpoint with Siphon", "Investigate SSO redirect chain for SAML misconfiguration".
Output Files
| File | Format | Description |
|---|---|---|
meta.json |
JSON | Tool identity and engagement metadata |
findings.json |
JSON | Universal findings array v1.1 |
findings.csv |
CSV | CSV mirror of findings |
summary.json |
JSON | Aggregated statistics |
scan.log |
TXT | Human-readable timestamped log |
scan.log.json |
JSONL | Machine-readable JSON log events |
errors.log |
TXT | ERROR-level entries only |
Invocation Methods
| Method | Usage |
|---|---|
| CLI — Direct |
cd /opt/pr0t31n/AuthProbe && python3 authprobe.py [OPTIONS]
Run directly with command-line arguments. |
Integration
Used By
- Fracture (uses auth config)
- Siphon (uses auth config)
- Crucible (pre-scan probe)
Third-Party Dependencies & Credits
| Tool / Library | Developer | Type | Link |
|---|---|---|---|
| requests | Kenneth Reitz / Python Software Foundation | python | https://github.com/psf/requests |
Metadata
| Name | AuthProbe |
| Category | Recon |
| Version | 2.15.0 |
| Install Path | /opt/pr0t31n/AuthProbe |
| Main File | authprobe.py |
| GitHub | https://github.com/pr0t31n/AuthProbe.git |