---
id: 5061
title: "Introducing SignSaboteur: forge signed web tokens with ease"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/introducing-signsaboteur-forge-signed-web-tokens-with-ease"
published_at: "2024-06-04T07:25:00Z"
tags: ["burp-suite", "authentication", "jwt", "tooling", "brute-force", "signed-tokens"]
phying_url: "https://phying.com/item/5061"
lang: en
---

# Introducing SignSaboteur: forge signed web tokens with ease

## Summary

SignSaboteur is an open-source Burp extension for editing, signing, verifying and attacking signed tokens — JWT, Django, Flask, Express — with default-secret wordlists and automated brute-forcing.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2024-06-04T07:25:00Z
- **Original:** https://portswigger.net/research/introducing-signsaboteur-forge-signed-web-tokens-with-ease
- **Phying News:** https://phying.com/item/5061