whs-authz-authn/caido-plugin-test
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #20 from whs-authz-authn-project/feature/access-token-detector

Browse source 
[FIX] AccessToken 탐지 정확도 증가
This commit is contained in:
James 2025-06-04 22:03:47 +09:00 • committed by GitHub
commit d2c95cff2e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 48 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

71
packages/backend/src/controller/accessTokenDetector.ts
View file

@ -132,34 +132,53 @@ export class AccessTokenLeakController {
* @param text - 검사할 텍스트 * @param text - 검사할 텍스트
* @returns 토큰 값이 있으면 해당 값, 없으면 null * @returns 토큰 값이 있으면 해당 값, 없으면 null
*/ */
private extractTokenFromText(text: string): string | null { private extractTokenFromText(text: string): string | null {
// 토큰 관련 키워드 리스트 // 토큰 관련 키워드 리스트
const tokenKeys = [ const tokenKeys = [
'access_token', 'access_token',
'accesstoken', 'accesstoken',
'Access-Token', 'Access-Token',
'Refresh_Token', 'Refresh_Token',
'Refresh-Token', 'Refresh-Token',
'RefreshToken', 'RefreshToken',
'Secret_Token', 'Secret_Token',
'Secret-Token', 'Secret-Token',
'SecretToken', 'SecretToken',
'SSO_Auth', 'SSO_Auth',
'SSO-Auth', 'SSO-Auth',
'SSOAuth', 'SSOAuth',
'auth_token', 'auth_token',
'session_token' 'session_token'
]; ];
// 정규표현식 패턴 리스트 생성 const tokenTypeKeys = [
'token_type',
'tokenType'
];
// 정규표현식 토큰 타입 유무 패턴 리스트 생성
const tokenTypeRegexes: RegExp[] = [];
for (const key of tokenTypeKeys) {
// JSON 형식: "token_type": "Bearer"
tokenTypeRegexes.push(new RegExp(`"${key}"\\s*:\\s*"bearer"`, 'i'));
// 일반 key=value 형식: token_type=Bearer
tokenTypeRegexes.push(new RegExp(`${key}[=:]\\s*bearer`, 'i'));
// 공백 있는 형식: token_type : Bearer
tokenTypeRegexes.push(new RegExp(`${key}\\s*:\\s*bearer`, 'i'));
}
// token_type=bearer 형태 중 하나라도 포함되는지 확인
const hasTokenTypeBearer = tokenTypeRegexes.some(rx => rx.test(text));
// 정규표현식 토큰 유무 패턴 리스트 생성
const tokenPatterns: RegExp[] = []; const tokenPatterns: RegExp[] = [];
for (const key of tokenKeys) { for (const key of tokenKeys) {
// 1. key=token 또는 key: token // 1. key=token 또는 key: token
tokenPatterns.push(new RegExp(`${key}[=:]\\s*([a-zA-Z0-9\\-._~+/]+=*)`, 'i')); tokenPatterns.push(new RegExp(`${key}[=:]\\s*([a-zA-Z0-9\\-._~+/]+=*)`, 'i'));
// 2. JSON 형태의 "key": "token" // 2. JSON 형태의 "key": "token"
tokenPatterns.push(new RegExp(`"${key}"\\s*:\\s*"([^"]+)"`, 'i')); tokenPatterns.push(new RegExp(`"${key}"\\s*:\\s*"([^"]+)"`, 'i'));
} }
// 3. Authorization: Bearer <token> 형태 // 3. Authorization: Bearer <token> 형태
@ -167,12 +186,14 @@ private extractTokenFromText(text: string): string | null {
// 모든 패턴에 대해 검사 // 모든 패턴에 대해 검사
for (const pattern of tokenPatterns) { for (const pattern of tokenPatterns) {
const match = pattern.exec(text); const match = pattern.exec(text);
if (match && match[1]) { if (match && match[1]) {
return match[1]; if(hasTokenTypeBearer){
return match[1];
} }
}
} }
return null; return null;
} }
} }

2
packages/backend/src/index.ts
View file

@ -22,7 +22,6 @@ export function init(sdk: SDK<API>) {
sdk.events.onInterceptResponse(async (sdk, req: Request, res: Response) => { sdk.events.onInterceptResponse(async (sdk, req: Request, res: Response) => {
await csrfCheck.checker(sdk, req, res); await csrfCheck.checker(sdk, req, res);
//await pkceCheckController.test(sdk, req); //await pkceCheckController.test(sdk, req);
await tokenCheck.testReq(sdk, req);
await tokenCheck.testResp(sdk, res, req); await tokenCheck.testResp(sdk, res, req);
await ScopeDetectionController.scan(sdk, req.getUrl()); await ScopeDetectionController.scan(sdk, req.getUrl());
await redirectBypassController.testAsync(sdk, req, res); await redirectBypassController.testAsync(sdk, req, res);
@ -38,6 +37,7 @@ export function init(sdk: SDK<API>) {
}); });
sdk.events.onInterceptRequest(async (sdk, req: Request) => { sdk.events.onInterceptRequest(async (sdk, req: Request) => {
await tokenCheck.testReq(sdk, req);
await pkceCheckController.test(sdk, req); await pkceCheckController.test(sdk, req);
}); });
/* /*