PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

PimpMyBurp #11 – Master Signed Token Exploits with SignSaboteur

yeswehack.com | blog | #burp-suite | #authentication-bypass | #web-security | #brute-force | #extension | #signed-tokens
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PimpMyBurp #11 on SignSaboteur, a Burp Suite extension for assessing and exploiting signed web tokens (Django, Flask, Express): inline editing, secret-key brute forcing, and auth-bypass attacks.
Published
Collected

Related coverage

blog · netspi.com
Exploiting XPath Injection Weaknesses
A technical walkthrough of XPath injection: how unvalidated input in XML queries enables authentication bypass and data theft, with a vulnerable lab and Burp Suite techniques for identifying the flaw.
blog · netspi.com
CAPTCHAs Done Right?
Shows how a CAPTCHA that can be solved once and replayed fails to stop brute force - a password was cracked on the 86th try - and lists checks like one-time use and session binding.
research · portswigger.net
Introducing SignSaboteur: forge signed web tokens with ease
SignSaboteur is an open-source Burp extension for editing, signing, verifying and attacking signed tokens — JWT, Django, Flask, Express — with default-secret wordlists and automated brute-forcing.
blog · yeswehack.com
PimpMyBurp #10: Hackvertor – unleashing the power of Burp Suite
PimpMyBurp #10: using Hackvertor, a Burp Suite extension that modifies requests via tags — custom tags in JS/Python/Java/Groovy, on-the-fly fuzzing, fake data and IP spoofing for filter bypass.
blog · portswigger.net
Heading to San Francisco? Meet PortSwigger at OWASP Global AppSec USA 2026
Join us at booth G14 on 5–6 November at the Hyatt Regency San Francisco. We’re a Gold sponsor, with live Burp AT demos, conversations about your AppSec programme, and something new to share. OWASP is
blog · portswigger.net
PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) became the latest vulnerability to grab headlines around the globe. By some estimates, up to 70% of websites run at least some PHP. So if you're respons
Back