Metadata-Version: 2.4
Name: ptaccount
Version: 0.0.1
Summary: Testing tool for web application account security (login case sensitivity, password reflection, user enumeration)
Home-page: https://www.penterep.com/
Author: Penterep
Author-email: info@penterep.com
License: GPLv3
Project-URL: homepage, https://www.penterep.com/
Project-URL: repository, https://github.com/penterep/ptaccount
Project-URL: tracker, https://github.com/penterep/ptaccount/issues
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: Implementation :: CPython
Classifier: Environment :: Console
Classifier: Topic :: Security
Classifier: License :: OSI Approved :: GNU General Public License v3 (GPLv3)
Requires-Python: >=3.12
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: ptlibs<2,>=1.0.50
Dynamic: author
Dynamic: author-email
Dynamic: classifier
Dynamic: description
Dynamic: description-content-type
Dynamic: home-page
Dynamic: license
Dynamic: license-file
Dynamic: project-url
Dynamic: requires-dist
Dynamic: requires-python
Dynamic: summary

[![penterepTools](https://www.penterep.com/external/penterepToolsLogo.png)](https://www.penterep.com/)


## PTACCOUNT

Testing tool for web application account/login security.

## Installation

```
pip install ptaccount
```

## Adding to PATH
If you're unable to invoke the script from your terminal, it's likely because it's not included in your PATH. You can resolve this issue by executing the following commands, depending on the shell you're using:

For Bash Users
```bash
echo "export PATH=\"`python3 -m site --user-base`/bin:\$PATH\"" >> ~/.bashrc
source ~/.bashrc
```

For ZSH Users
```bash
echo "export PATH=\"`python3 -m site --user-base`/bin:\$PATH\"" >> ~/.zshrc
source ~/.zshrc
```

## Usage examples
```
ptaccount -u https://www.example.com/login --login bob --password Secret123 --fail-match "Invalid credentials"
ptaccount -rf login_request.txt --login-param username --password-param password --login bob --password Secret123 --success-match "Welcome"
ptaccount -u https://www.example.com/login --login bob --fail-match "Invalid credentials" -ts LGENUM -w logins.txt
```

The login request can be described in one of two ways:
- `-u/--url` + `--login-param`/`--password-param` - ptaccount builds the request body itself (form-encoded or JSON).
- `-rf/--request-file` - a raw HTTP request file (e.g. exported from Burp/ZAP); the login/password values are substituted into it by parameter name.

At least one of `--success-match`/`--fail-match` (a string, or a regex with `--match-mode regex`) is required for LGPWCASE and LGREFLEXPW so ptaccount can tell a successful login from a failed one.

## Options
```
   -u   --url               <url>             Login endpoint URL (required unless -rf is used)
   -rf  --request-file      <file>            Raw HTTP request file for the login request
   -ts  --tests             <test>            Specify one or more tests to perform:
                             LGENUM            Test for login user enumeration
                             LGPWCASE          Test login password case sensitivity
                             LGREFLEXPW        Test whether login reflects submitted password

   -w   --wordlist          <file>            Login wordlist file (enables LGENUM enumeration mode)
   -m   --method            <method>          HTTP method when building request from -u (default POST)
        --content-type      <form|json>       Body encoding when building request from -u (default form)
        --scheme            <http|https>      Scheme used with -rf (default https)
        --login-param       <name>            Name of the login/username parameter (default username)
        --password-param    <name>            Name of the password parameter (default password)
        --login             <login>           Known-valid login
        --password          <password>        Known-valid password for --login
        --invalid-login     <login>           A login known not to exist (default: random)
        --invalid-password  <password>        A wrong password to use where a real one isn't needed (default: random)
        --success-match     <text>            Text/regex present only in a successful login response
        --fail-match        <text>            Text/regex present only in a failed login response
        --match-mode        <string|regex>    How to interpret --success-match/--fail-match (default string)
   -p   --proxy             <proxy>           Set proxy (e.g. http://127.0.0.1:8080)
   -T   --timeout                             Set timeout (default 10)
   -t   --threads           <threads>         Set thread count for LGENUM wordlist mode (default 10)
   -c   --cookie            <cookie>          Set cookie
   -a   --user-agent        <a>               Set User-Agent header
   -H   --headers           <header:value>    Set custom header(s)
   -r   --redirects                           Follow redirects (default False)
   -C   --cache                               Cache HTTP communication
   -vv  --verbose                             Enable verbose mode
   -v   --version                             Show script version and exit
   -h   --help                                Show this help message and exit
   -j   --json                                Output in JSON format
```

## Tests
```
LGPWCASE     Sends the known-valid login with case-altered variants of the known-valid
             password (UPPER/lower/sWAP) and flags the login as vulnerable if the server
             still accepts any of them - i.e. password comparison is not case sensitive.

LGREFLEXPW   Sends three login requests (correct credentials, wrong login, wrong password)
             and checks whether the submitted password value is echoed back in the response.

LGENUM       Compares the login response for a known-existing login against a known-nonexistent
             login (status code, response content similarity, response time). If they differ,
             the app is vulnerable to user enumeration. Adding -w/--wordlist enumerates every
             login in the wordlist against the two learned response signatures and returns the
             list of logins that appear to exist.
```

## Dependencies
```
ptlibs
```

## License

Copyright (c) 2026 Penterep Security s.r.o.

ptaccount is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

ptaccount is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with ptaccount. If not, see https://www.gnu.org/licenses/.

## Warning

You are only allowed to run the tool against the websites which
you have been given permission to pentest. We do not accept any
responsibility for any damage/harm that this application causes to your
computer, or your network. Penterep is not responsible for any illegal
or malicious use of this code. Be Ethical!
