Feature request: Duo Security AD FS login portal module

[s-miller-001]

I have a client who has a client-branded Duo Security AD FS login portal, with an AuthURL similar to the following:

https://sso-xxxxxxxx.sso.duosecurity.com/saml2/sp/XXXXXXXXXXXXXXXXXXXX/sso

I can also visit https://example.login.duosecurity.com/ (where "example" equals the client name), which then redirects to:

https://example.login.duosecurity.com/login/?authkey=XXXXXXXXXXXXXXXXXXXX&scid=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The "Single Sign-On" page first accepts an "Email Address", and after entering the email address and clicking "Next" you are presented with a different screen prompting for the "Password", which after entering you would attempt to "Log in".

Would it be possible to create a TREVORspray "Duo Security" module for this?

[TheTechromancer]

Yes, it is possible to create modules for almost any signin process, even ones that have multiple steps. For a rough idea of how to do this, you may want to take a look at the jumpcloud module, which makes use of multiple requests to retrieve CSRF tokens, etc.

Writing a module can be a bit challenging, so if Python isn't your first choice, and you're only using trevorspray for its IP-rotation capability, you might consider using BurpSuite or bash, and proxying the traffic through trevorproxy instead.