PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Introducing SignSaboteur: forge signed web tokens with ease

portswigger.net | research | #burp-suite | #authentication | #jwt | #tooling | #brute-force | #signed-tokens
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

SignSaboteur is an open-source Burp extension for editing, signing, verifying and attacking signed tokens — JWT, Django, Flask, Express — with default-secret wordlists and automated brute-forcing.
Published
Collected

Related coverage

blog · netspi.com
CAPTCHAs Done Right?
Shows how a CAPTCHA that can be solved once and replayed fails to stop brute force - a password was cracked on the 86th try - and lists checks like one-time use and session binding.
blog · yeswehack.com
PimpMyBurp #11 – Master Signed Token Exploits with SignSaboteur
PimpMyBurp #11 on SignSaboteur, a Burp Suite extension for assessing and exploiting signed web tokens (Django, Flask, Express): inline editing, secret-key brute forcing, and auth-bypass attacks.
blog · netspi.com
Why TOTP Won’t Cut It (And What to Consider Instead)
NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.
blog · netspi.com
Introducing Burp Extractor
Will Strei introduces Burp Extractor, a Burp Suite extension that extracts dynamic values like anti-CSRF tokens from responses via regex and reinserts them into requests, a generalized cookie jar.
blog · netspi.com
Targeting RSA Emergency Access Tokencodes for Fun and Profit
Shows how an attacker with domain credentials can request an RSA Emergency Access Tokencode from the self-service console and brute force the numeric PIN, turning recovery features into a 2FA bypass.
blog · netspi.com
Beautifying JSON in Burp
A native Java Burp extension that beautifies JSON in place, letting testers read and live-edit nested API responses without Jython, with edits synced back to the raw request tab.
Back