rub-nds / openid-attacker Goto Github PK

The login algorithm cannot login to websites with mixed content warning: "Although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party."

The automated login on http://www.scribblelive.com/openid/Login.aspx does not work.

Start a new training without altering the URL.

If the Selenium-Browser is (accidentally) closed, e.g. after the training, it cannot be reopend.

In check_authentication mode, the analyzer IdP may return true or false, but the Log-Title will always show true.

Allow to cancel attacks.

OpenID-Attacker needs to setup two Servers to work.
Some OpenID SPs are only allowed to communicates with Servers on Port 80.

Consequently it is best to use OpenID-Attacker on a Computer that has two different NICs, for example, one listening on one.openid.com and onother on two.openid.com.
Both NICs should be used on port 80.

This is currently not possilble.

OpenID Attacker seems to use the following fixed URL instead of the current one:

<!DOCTYPE XRDS [
  <!ENTITY url1 "http://my-idp.xyz/x">
  <!ENTITY url2 "xe">
  <!ENTITY url3 "&url1;&url2;">
]>

Allow to cancel the training.

Feature Request: Ability to resize Log-Table and Request/Response window

At start-up without a config file the Attacker IdP -> Valid Data is identical to Analyzer IdP -> Valid Data.

<!ENTITY url PUBLIC 'm' 'http://bad.nds.rub.dexxe'>