ptaccount 0.0.3

PTACCOUNT

Testing tool for web application account/login security.

Installation

pip install ptaccount

Adding to PATH

If you're unable to invoke the script from your terminal, it's likely because it's not included in your PATH. You can resolve this issue by executing the following commands, depending on the shell you're using:

For Bash Users

echo "export PATH=\"`python3 -m site --user-base`/bin:\$PATH\"" >> ~/.bashrc
source ~/.bashrc

For ZSH Users

echo "export PATH=\"`python3 -m site --user-base`/bin:\$PATH\"" >> ~/.zshrc
source ~/.zshrc

Usage examples

ptaccount -u https://www.example.com/login --login bob --password Secret123 --fail-match "Invalid credentials"
ptaccount -rf login_request.txt --login-param username --password-param password --login bob --password Secret123 --success-match "Welcome"
ptaccount -u https://www.example.com/login --login bob --fail-match "Invalid credentials" -ts LGENUM -wl logins.txt

The login request can be described in one of two ways:

• -u/--url + --login-param/--password-param - ptaccount builds the request body itself (form-encoded or JSON).
• -rf/--request-file - a raw HTTP request file (e.g. exported from Burp/ZAP); the login/password values are substituted into it by parameter name.

At least one of --success-match/--fail-match (a string, or a regex with --match-mode regex) is required for LGPWCASE and LGREFLEXPW so ptaccount can tell a successful login from a failed one.

Options

   -u   --url               <url>             Login endpoint URL (required unless -rf is used)
   -rf  --request-file      <file>            Raw HTTP request file for the login request
   -ts  --tests             <test>            Specify one or more tests to perform:
                             LGENUM            Test for login user enumeration
                             LGPWCASE          Test login password case sensitivity
                             LGREFLEXPW        Test whether login reflects submitted password

   -wl  --wordlist-login    <file>            Login wordlist file
   -wp  --wordlist-passwords <file>           Password wordlist file
   -m   --method            <method>          HTTP method when building request from -u (default POST)
        --content-type      <form|json>       Body encoding when building request from -u (default form)
        --scheme            <http|https>      Scheme used with -rf (default https)
        --login-param       <name>            Name of the login/username parameter (default username)
        --password-param    <name>            Name of the password parameter (default password)
        --login             <login>           Known-valid login
        --password          <password>        Known-valid password for --login
        --invalid-login     <login>           A login known not to exist (default: random)
        --invalid-password  <password>        A wrong password to use where a real one isn't needed (default: random)
        --success-match     <text>            Text/regex present only in a successful login response
        --fail-match        <text>            Text/regex present only in a failed login response
        --match-mode        <string|regex>    How to interpret --success-match/--fail-match (default string)
   -p   --proxy             <proxy>           Set proxy (e.g. http://127.0.0.1:8080)
   -T   --timeout                             Set timeout (default 10)
   -t   --threads           <threads>         Set thread count for LGENUM wordlist mode (default 10)
   -c   --cookie            <cookie>          Set cookie
   -a   --user-agent        <a>               Set User-Agent header
   -H   --headers           <header:value>    Set custom header(s)
   -r   --redirects                           Follow redirects (default False)
   -C   --cache                               Cache HTTP communication
   -vv  --verbose                             Enable verbose mode
   -v   --version                             Show script version and exit
   -h   --help                                Show this help message and exit
   -j   --json                                Output in JSON format

Tests

LGPWCASE     Sends the known-valid login with case-altered variants of the known-valid
             password (UPPER/lower/sWAP) and flags the login as vulnerable if the server
             still accepts any of them - i.e. password comparison is not case sensitive.

LGREFLEXPW   Sends three login requests (correct credentials, wrong login, wrong password)
             and checks whether the submitted password value is echoed back in the response.

LGENUM       Compares the login response for a known-existing login against a known-nonexistent
             login (status code, response content similarity, response time). If they differ,
             the app is vulnerable to user enumeration. Adding -wl/--wordlist-login enumerates every
             login in the wordlist against the two learned response signatures and returns the
             list of logins that appear to exist.

Dependencies

ptlibs

License

Copyright (c) 2026 Penterep Security s.r.o.

ptaccount is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

ptaccount is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with ptaccount. If not, see https://www.gnu.org/licenses/.

Warning

You are only allowed to run the tool against the websites which you have been given permission to pentest. We do not accept any responsibility for any damage/harm that this application causes to your computer, or your network. Penterep is not responsible for any illegal or malicious use of this code. Be Ethical!