salsa - SALSA 💃⚡ - SALesforce Scanner for Aura (and beyond

项目说明

SALSA - *SALesforce Scanner for Aura (and beyond)*

<p align="center">
<img src="./assets/logo.jpeg" width="150">

SALSA has been de on a lot of my personal free time, to help me on pentesting and bug hunting activites against Salesforce Lightning (Aura) and API assets. Please note it is fully experimental.

I decided to share it for free, to help the community.
*If you would ever like to buy me a coffee or a beer* 😇 :

!["Buy Me A Coffee"]()

</p>

Features

⚠️: *dangerous & experimental*

Usage

Help

Examples

<details>
<summary>Simple scan - Unauthenticated</summary>

</details>

<details>
<summary>Simple scan - Unauthenticated - Custom types only</summary>

</details>

<details>
<summary>Simple scan - Unauthenticated - Targetted record type and bruteforce</summary>

</details>

<details>
<summary>Simple scan - Authenticated - Targetted record type</summary>

</details>

<details>
<summary>Simple scan - Authenticated - Custom record types dump</summary>

Dumped records will be stored into a timestamped output folder

</details>

Current limitations

TODO

*Release date: maybe one day*

Troubleshooting

> Disclaimer: "spaghetti code" here, due to Salesforce technical contexts disco, mixed between official documentations, write-ups, reverse engineering, empirical tests. Hence I could study for small new features proposals or major bug fixes, this tool is now hard to maintain.

*Then, before opening an issue, please consider the following points:*

1. I strongly encourage you to switch the logging level to DEBUG or TRACE level (--debug / --trace).
2. The tool can send thousand of requests and works for hours. Two possible consequences:

3. I think the tool is adapted to most of Salesforce contexts, but not all of them.
4. Route the tool an HTTP proxy for further in (--proxy 127.0.0.1:8080 for instance)

Q/A

*Why is the authentication username/password does not work ?*

> Because the target is maybe not using the Aura Controller apex://LightningLoginFormController/ACTION$login: prefer using the sid (session id) or token (Aura token) after a manual authentication.

*What's is the difference between sid and token ?*

> The token is used for authenticated Aura controller interactions. The sid is used to interact with other APIs (and sometimes Aura controllers). The format are not the same though: for the token it is more like a JWT, for the sid it is prefixed by the organization identifier.

*Why there are limitations regarding the amount of data dump in queries for example ?*

> Yes, it could be improved with new arguments. The initial reason was that the tool can launch thousand of requests and could last for hours (Entities count / fields cound / controllers count / services count / etc.). The limitations are present to reduce the duration. Feel free to change that.

*How do I find targets ?*

> It is up to you, but it can be done with nuclei: nuclei -rl 10 -t "http/misconfiguration/salesforce-aura.yaml" -l subdomains.txt

*Why the source code is so complex ? Why Java ?*

> In the beginning it was a clean set of small scripts. Disco after disco, I ha, modified, removed some parts. Without unit tests. And Salesforce contexts are very complex / customisable, targets behaviors can differ and code is adapted with some unelegant if/then/else. The last reason is that I wanted to have the most adaptable and automatized tool for this kind of assessment. I dig into complex workflows, but abandonned some steps. Why Java ? Because Salesforce APEX is very close to Java, and Salesforce have some libraries in Ja could be decompiled to be dynamically integrated into the tool. And I like Ja is perfect).

Credits and ressources

Thanks for all these ressources (tools, write-ups, docs, ...), which help me a lot:

Licence

Released under GPL-3.0 license.

项目信息

开发语言：Java

Star 数：32

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕SALSA 💃⚡ - SALesforce Scanner for Aura (and beyond). Enumeration of vulnerabilities and misconfigurations against Salesforce endpoint.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。