Metadata-Version: 2.4
Name: ptaccount
Version: 0.0.4
Summary: Testing tool for web application account security (login case sensitivity, password reflection, user enumeration)
Home-page: https://www.penterep.com/
Author: Penterep
Author-email: info@penterep.com
License: GPLv3
Project-URL: homepage, https://www.penterep.com/
Project-URL: repository, https://github.com/penterep/ptaccount
Project-URL: tracker, https://github.com/penterep/ptaccount/issues
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: Implementation :: CPython
Classifier: Environment :: Console
Classifier: Topic :: Security
Classifier: License :: OSI Approved :: GNU General Public License v3 (GPLv3)
Requires-Python: >=3.12
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: ptlibs<2,>=1.0.50
Dynamic: author
Dynamic: author-email
Dynamic: classifier
Dynamic: description
Dynamic: description-content-type
Dynamic: home-page
Dynamic: license
Dynamic: license-file
Dynamic: project-url
Dynamic: requires-dist
Dynamic: requires-python
Dynamic: summary

[![penterepTools](https://www.penterep.com/external/penterepToolsLogo.png)](https://www.penterep.com/)


## PTACCOUNT

Testing tool for web application account/login security.

## Installation

```
pip install ptaccount
```

## Adding to PATH
If you're unable to invoke the script from your terminal, it's likely because it's not included in your PATH. You can resolve this issue by executing the following commands, depending on the shell you're using:

For Bash Users
```bash
echo "export PATH=\"`python3 -m site --user-base`/bin:\$PATH\"" >> ~/.bashrc
source ~/.bashrc
```

For ZSH Users
```bash
echo "export PATH=\"`python3 -m site --user-base`/bin:\$PATH\"" >> ~/.zshrc
source ~/.zshrc
```

## Usage examples
```
ptaccount --login-file login_workflow.json --login bob --password Secret123
ptaccount --login-file login_workflow.json --login bob --password Secret123 -ts LGENUM -wl logins.txt
```

The login request is described by `--login-file`, a JSON array of steps (a file path, or the
JSON itself base64-encoded). Each step sends a raw HTTP request - with `{{login}}`/`{{password}}`
(and any value extracted by an earlier step) substituted in - and pulls values out of the
response via named regexes; a plain match-only pattern acts as a presence check. A workflow with
more than one step lets you describe a CSRF-token fetch, a 2FA step, etc. before the request that
actually submits the credentials.

A single-request login:
```json
[
  {
    "action": "send_request",
    "schema": "https",
    "content": "POST /user/login.php HTTP/1.1\r\nHost: www.example.com\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\nlogin={{login}}&heslo={{password}}",
    "regex": {
      "sid": "PHPSESSID=([^;]+)",
      "fail": "Přihlášení se nezdařilo"
    }
  }
]
```

A login preceded by a CSRF-token fetch:
```json
[
  {
    "action": "send_request",
    "schema": "https",
    "content": "GET / HTTP/1.1\r\nHost: www.example.com\r\n\r\n",
    "regex": {"csrf": "csrftoken=([^;]+)"}
  },
  {
    "action": "send_request",
    "schema": "https",
    "content": "POST /user/login.php HTTP/1.1\r\nHost: www.example.com\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\nlogin={{login}}&heslo={{password}}&csrftoken={{csrf}}",
    "regex": {
      "sid": "PHPSESSID=([^;]+)",
      "fail": "Přihlášení se nezdařilo"
    }
  }
]
```

The **last** step's `regex` must extract a variable named `success` or `fail` for LGPWCASE,
LGREFLEXPW, LGSESSFIX and LGMETHODS, so ptaccount can tell a successful login from a failed one.

`--register-file` takes the same shape for a future registration-testing workflow; no test uses
it yet.

## Options
```
        --login-file        <file|base64>     JSON workflow describing how to submit the login request (required)
        --register-file     <file|base64>     JSON workflow describing how to submit a registration request
   -ts  --tests             <test>            Specify one or more tests to perform:
                             LGENUM            Test for login user enumeration
                             LGPWCASE          Test login password case sensitivity
                             LGREFLEXPW        Test whether login reflects submitted password

   -wl  --wordlist-login    <file>            Login wordlist file
   -wp  --wordlist-passwords <file>           Password wordlist file
        --login             <login>           Known-valid login
        --password          <password>        Known-valid password for --login
        --invalid-login     <login>           A login known not to exist (default: random)
        --invalid-password  <password>        A wrong password to use where a real one isn't needed (default: random)
   -p   --proxy             <proxy>           Set proxy (e.g. http://127.0.0.1:8080)
   -T   --timeout                             Set timeout (default 10)
   -t   --threads           <threads>         Set thread count for LGENUM wordlist mode (default 10)
   -r   --redirects                           Follow redirects (default False)
   -C   --cache                               Cache HTTP communication
   -vv  --verbose                             Enable verbose mode
   -v   --version                             Show script version and exit
   -h   --help                                Show this help message and exit
   -j   --json                                Output in JSON format
```

## Tests
```
LGPWCASE     Sends the known-valid login with case-altered variants of the known-valid
             password (UPPER/lower/sWAP) and flags the login as vulnerable if the server
             still accepts any of them - i.e. password comparison is not case sensitive.

LGREFLEXPW   Sends three login requests (correct credentials, wrong login, wrong password)
             and checks whether the submitted password value is echoed back in the response.

LGENUM       Compares the login response for a known-existing login against a known-nonexistent
             login (status code, response content similarity, response time). If they differ,
             the app is vulnerable to user enumeration. Adding -wl/--wordlist-login enumerates every
             login in the wordlist against the two learned response signatures and returns the
             list of logins that appear to exist.
```

## Dependencies
```
ptlibs
```

## License

Copyright (c) 2026 Penterep Security s.r.o.

ptaccount is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

ptaccount is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with ptaccount. If not, see https://www.gnu.org/licenses/.

## Warning

You are only allowed to run the tool against the websites which
you have been given permission to pentest. We do not accept any
responsibility for any damage/harm that this application causes to your
computer, or your network. Penterep is not responsible for any illegal
or malicious use of this code. Be Ethical!
