browser-identity-attacks-matrix - Offensive security drives defensive security. We'r

项目说明

<di="center">

![badge]()
![badge]()
![badge]()
![badge]()
![badge]()

<a href="
<picture>
<source media="(prefers-color-scheme: dark)" srcset="
<img src=" width="400">
</picture>
</a>

</div>

Browser & Identity Attacks Matrix

This repository is a collection of browser and identity attack techniques co SaaS apps, browser-based attacks, identity pro, and phishing. It is intended to be a resource for security researchers, red/blue teams, and penetration testers to learn about and share these attack techniques.

> Name change notice: This project was pre known as the *SaaS Attacks Matrix*. We' it to the *Browser & Identity Attacks Matrix* to better reflect its expanding scope — including browser-based attack techniques (like malicious extensions and phishing) and identity-layer attacks that don't fit neatly under the "SaaS" label. All existing links and references to this repo continue to work; only the name has changed.

> Quick note: we wanted to start sharing as early as possible, so this is very much a work in progress. Hopefully there is enough to see the shape of things to come, but no doubt there are gaps - we'll be filling them in over the coming weeks and months. If you can help fill in some references, add examples, or point us to missing techniques - please open an issue (or even a PR)! We'll be very sure to credit you.

For more information on the background to this project, check the following blog post

The Microsoft BlueHat 2023 "The new SaaS cyber kill chain" presentation that covers a lot of this research can be found below:

BlueHat - The new SaaS cyber kill chain

For a podcast co this topic, checkout the DCP Podcast by SpectreOps below:

DCP Podcast - Episode 35

The Browser & Identity Attacks Matrix

We’ inspiration from the MITRE ATT&CK framework (certainly intended as the sincerest form of flattery), but wanted to make a conscious break away from the endpoint-focused ATT&CK techniques and instead focus on techniques targeting browsers, identity systems, and SaaS applications. In fact, none of these techniques touch endpoints or customer networks - so we’re calling them networkless attacks.

| Reconnaissance | Initial Access | Execution | Persistence | Pri Escalation | Defense E | Credential Access | Discovery | Lateral Mo | Exfiltration |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|SAML enumeration|Consent phishing|Shadow workflows|API keys|Link backdooring|API keys|Password scraping|Email discovery|Link backdooring|Takeout services|
|Subdomain tenant discovery|Poisoned tenants|OAuth tokens|OAuth tokens|Abuse existing OAuth integrations|OAuth tokens|API secret theft|App directory lookup|Abuse existing OAuth integrations|Webhooks|
|Slug tenant enumeration|SAMLjacking|Client-side app spoofing|Evil twin integrations|Malicious mail rules|Evil twin integrations||OAuth token enumeration|API secret theft|Shadow workflows|
|DNS reconnaissance|Account ambushing||Malicious mail rules||Malicious mail rules|||Passwordless logins|
|Username enumeration|Credential stuffing||Link sharing||Link sharing|||Account recovery||
||App spraying||System integrations||System integrations|||In-app phishing||
||Email phishing||Ghost logins||Ghost logins|||IM user spoofing||
||IM phishing||Client-side app spoofing||Client-side app spoofing|||Automation workflow sharing||
||IM user spoofing||Inbound federation||Device code phishing|||SAMLjacking||
||nOAuth||Device enrollment||Session cookie theft|||Inbound federation||
||MFA fatigue||Cross-idp impersonation||ConsentFix|||Session cookie theft||
||Device code phishing||App-specific password phishing|||||||
||Hijack OAuth flows|||||||||
||AiTM Phishing|||||||||
||Device enrollment|||||||||
||Ghost logins|||||||||
||MFA downgrade|||||||||
||Guest access abuse|||||||||
||Cross-idp impersonation|||||||||
|| phishing|||||||||
||UI redressing|||||||||
||App-specific password phishing|||||||||
||ConsentFix|||||||||

Another di from the ATT&CK framework is that these techniques are not solely based on obser. Instead, we’re allowing more exploratory techniques that haven't been seen in the wild. We think this is important because SaaS and identity are relatively new attack surfaces, and we want to encourage security researchers to think creatively about how they — and the browser-based techniques used to attack them — can be abused to better anticipate future attacks.

We’ve also removed a few columns that are common in these MITRE-style frameworks, some (like Impact) are so similar they aren't worth duplicating. Others (perhaps most notably the Command & Control phase) because they no longer apply. Since SaaS is delivered directly on the internet, you can’t force an attacker to access it through your web gateway. You can try forcing your own employees through a gateway, but attackers can access it directly like e else (there are edge cases here, but they are rare). This means there is generally no need for C2 techniques.

Finally, some need a slightly broader definition. For example, the Execution phase includes techniques that are not strictly code execution on an endpoint, but achieve an equi outcome in a SaaS, identity, or browser context.

Scope

When we started this research project, the first task was to choose an initial scope. Like every good red-teamer, we wanted to start with low-cost techniques, so that means we were looking for techniques that:
* Avoid highly effecti that are expensive to bypass, especially endpoint controls like EDR - so endpoint malware-based techniques are out
* Look for features that can be abused long-term, rather than bugs that will be patched quickly - so no zero-days
* Go beyond the dozen or so core SaaS apps like O365 and Google Workspace - look to the hundreds of other apps that ha security controls and store or ha to highly sensitive data

While we left out techniques that are endpoint-based attacks leading to a SaaS, identity, or browser compromise (MITRE does a good job of these techniques) we think that techniques going the other way — from SaaS, identity, or the browser back to the endpoint — might make sense to add here.

项目信息

开发语言：未知

Star 数：1441

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Offensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they face. #nolockdown展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。