{"id":50969832,"url":"https://github.com/n3rada/sfmap","last_synced_at":"2026-06-19T01:01:29.694Z","repository":{"id":362701874,"uuid":"1260378180","full_name":"n3rada/sfmap","owner":"n3rada","description":"A Salesforce security assessment toolkit. Mapping the complexity.","archived":false,"fork":false,"pushed_at":"2026-06-05T14:33:32.000Z","size":83,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-05T15:19:19.520Z","etag":null,"topics":["aura","lightning-web-components","pentest","salesforce","salesforce-rest-api"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/n3rada.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-05T12:35:09.000Z","updated_at":"2026-06-05T14:34:01.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/n3rada/sfmap","commit_stats":null,"previous_names":["n3rada/sfmap"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/n3rada/sfmap","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n3rada%2Fsfmap","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n3rada%2Fsfmap/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n3rada%2Fsfmap/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n3rada%2Fsfmap/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/n3rada","download_url":"https://codeload.github.com/n3rada/sfmap/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n3rada%2Fsfmap/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34513029,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-18T02:00:06.871Z","response_time":128,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aura","lightning-web-components","pentest","salesforce","salesforce-rest-api"],"created_at":"2026-06-19T01:01:28.692Z","updated_at":"2026-06-19T01:01:29.665Z","avatar_url":"https://github.com/n3rada.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# sfmap\n\n**Salesforce Experience Cloud security assessment toolkit.** Enumerate guest and authenticated attack surfaces, probe IDOR, test CRUD and injection vectors, map REST and Aura endpoints, and generate a self-contained HTML report.\n\nWorks against any Experience Cloud portal from a guest session, an authenticated community user, or both.\n\nNew to Salesforce internals? Read [SALESFORCE_101.md](SALESFORCE_101.md) before starting an assessment.\n\n## Installation\n\n```bash\nuv tool install git+https://github.com/n3rada/sfmap.git\n```\n\nUpgrade:\n\n```bash\nuv tool upgrade sfmap\n```\n\nRun without installing:\n\n```bash\nuvx --from git+https://github.com/n3rada/sfmap.git sfmap --help\n```\n\n## Credentials\n\nSalesforce exposes two surfaces with different credential requirements.\n\n### Aura surface (community portal)\n\nAuthenticated requests need a session token and cookie. `ctx.json` (the Aura framework context) is auto-extracted if absent.\n\n| File | CLI flag | Value | Required |\n|---|---|---|---|\n| `ctx.json` | `-C` | `aura.context` JSON | auto-extracted if missing |\n| `token.txt` | `-T` | `aura.token` JWT from the POST body | optional |\n| `cookies.txt` | `--cookie` | Raw `Cookie:` header | yes (authenticated) |\n\nThe **session cookie** is what authenticates a Salesforce session. The `aura.token` is a CSRF token only; Salesforce issues one even to unauthenticated visitors. A run with no cookie (regardless of token) is treated as guest and output goes to `guest/`.\n\nCapture from DevTools: Network tab, filter by `aura`, click any POST to `/s/sfsites/aura`, copy the `Cookie:` header (for `cookies.txt`) and the `aura.token` field (for `token.txt`).\n\nWhen credential files are present in the working directory, no flags are needed:\n\n```bash\nsfmap target.my.site.com surface exposure\n```\n\n\u003e [!TIP]\n\u003e Drop a Burp Suite XML export or raw HTTP request as `burp.txt` in the working directory. sfmap parses it automatically and uses it in preference over `cookies.txt` and `token.txt`.\n\n\u003e [!NOTE]\n\u003e `aura.token` expiry is session-based, not timestamp-based. A token from an active browser session covers a full assessment. If requests return `Invalid token`, capture a fresh one.\n\n\u003e [!NOTE]\n\u003e If no credentials are found, every command runs as an unauthenticated guest automatically.\n\n### REST API surface\n\n`rest soql`, `rest tooling`, and the Bulk API require an OAuth Bearer token from a **full Salesforce license user** (internal org user, not a community member). Community sessions are blocked at the platform level regardless of credentials.\n\nCapture from DevTools on a session logged into `yourdomain.my.salesforce.com` (not the community portal):\n\n```bash\necho \"00DAP...\" \u003e bearer.txt\nsfmap target.my.site.com --bearer @bearer.txt rest soql\n```\n\n## Surfaces and Commands\n\n```\nsfmap URL aura    objects | dump | record | info | crud | inject | related |\n                  follow | idor | apex | controllers | flow | network |\n                  bootstrap | views\nsfmap URL rest    graphql introspect | query | dump\n                  content enum | download | distribution\n                  static | apexrest | soql | sosl | tooling | chatter\nsfmap URL surface exposure\nsfmap URL files   download ID\nsfmap URL assess\nsfmap     report  -o DIR\n```\n\n\u003e [!TIP]\n\u003e Run any command with `--help` for its options and flags.\n\n## Assessment Runbook\n\nReplace `TARGET` with your target domain throughout.\n\n**Run each phase twice:**\n\n1. **Authenticated**: with `token.txt`/`cookies.txt` (or `burp.txt`) present. Output lands in `salesforce_\u003cTARGET\u003e/\u003cusername\u003e/`.\n2. **Guest**: no credential files present. Output lands in `salesforce_\u003cTARGET\u003e/guest/`. The report then shows both tabs side by side.\n\n`ctx.json` is optional: if absent, sfmap auto-extracts the Aura context from the target and saves it for subsequent runs.\n\nRoute all traffic through Burp with `--proxy` appended to any command.\n\n### Full automated assessment (recommended)\n\n```bash\nsfmap TARGET assess\n```\n\nRuns all phases in sequence, skips phases already completed (sentinel files are checked), and generates the HTML report automatically at the end. Equivalent to running every phase below manually.\n\n### Manual phase-by-phase\n\n#### Phase 1: Surface Reconnaissance\n\n```bash\nsfmap TARGET surface exposure\nsfmap TARGET rest graphql introspect\nsfmap TARGET rest static\nsfmap TARGET rest apexrest\nsfmap TARGET rest chatter\nsfmap TARGET aura network\nsfmap TARGET aura bootstrap\n```\n\n#### Phase 2: Object Enumeration\n\n```bash\nsfmap TARGET aura objects\n```\n\n#### Phase 3: Object-Level Enumeration\n\n```bash\nsfmap TARGET aura dump\nsfmap TARGET aura crud\nsfmap TARGET aura inject\nsfmap TARGET aura views\nsfmap TARGET rest graphql query\nsfmap TARGET rest soql\nsfmap TARGET rest sosl\nsfmap TARGET aura flow\nsfmap TARGET aura controllers\n```\n\n#### Phase 4: Post-Dump Enumeration\n\n```bash\nsfmap TARGET rest graphql dump\nsfmap TARGET aura follow\nsfmap TARGET rest content enum\n```\n\n#### Phase 5: IDOR Probe\n\n```bash\nsfmap TARGET aura idor\n```\n\nRequires a prior `aura dump` in the same output directory to collect record IDs.\n\n#### Phase 6: Content Download (optional)\n\n```bash\nsfmap TARGET rest content download\nsfmap TARGET rest content distribution\n```\n\n### Report\n\n```bash\nsfmap report -o salesforce_TARGET\n```\n\nGenerates a self-contained `report.html` with one tab per identity (guest and authenticated), an IDOR findings table with owner attribution, and a browsable Record Browser for all dumped objects. Open directly in a browser — no server required.\n\n## Output\n\nAll output goes to a directory derived from the target URL (override with `-o`):\n\n```\nsalesforce_{host}/\n  {identity}/\n    exposure_summary.json\n    crud_probe.json\n    injection_findings.json\n    idor_findings.json\n    apexrest_hits.json\n    staticresource_summary.json, staticresource_*.bin\n    network_config.json\n    flow_hits.json\n    {Object}__page{N}.json\n    graphql/\n    chatter/\n    soql/\n    tooling/\n    downloads/\n  report.html\n```\n\n## aura.context\n\nRequired for every Aura request. Salesforce pushes framework builds three times a year; re-capture when every request returns `exceptionEvent: true`.\n\n```json\n{\n  \"mode\":   \"PROD\",\n  \"fwuid\":  \"a1dKZ0Zr...\",\n  \"app\":    \"siteforce:communityApp\",\n  \"loaded\": { \"APPLICATION@markup://siteforce:communityApp\": \"1652_-1TRj7Ek7\" },\n  \"dn\": [], \"globals\": {}, \"uad\": true\n}\n```\n\n## Prior Art\n\nsfmap was built after working with existing tools and hitting their limits on real engagements.\n\n[aura-inspector](https://github.com/google/aura-inspector) (Mandiant/Google) and [aura-dump](https://github.com/prjblk/aura-dump) (Project Black) both cover Aura object enumeration and record dumping via a single script. They require the caller to supply the full `aura.context` and token manually, operate on one object at a time, stop at a fixed page count, and produce raw JSON with no cross-run correlation. Neither covers REST surfaces (GraphQL, ApexREST, Chatter, SOQL), IDOR probing across sessions, CRUD/injection testing, or report generation.\n\nsfmap was written to run a complete assessment autonomously: auto-extracting the Aura context, paginating all objects to exhaustion, covering every REST surface, correlating findings across guest and authenticated sessions, and producing a structured HTML report suitable for a pentest deliverable.\n\n[Salesforce CLI (sf)](https://github.com/salesforcecli/cli) is the official tool for org inspection when admin credentials are in scope.\n\n## Disclaimer\n\nFor authorized security assessments, bug bounty programs, and penetration testing engagements only.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fn3rada%2Fsfmap","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fn3rada%2Fsfmap","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fn3rada%2Fsfmap/lists"}