PortSwigger Releases SignSaboteur: A Burp Suite Extension for Forging Signed Web Tokens
PortSwigger Research has introduced SignSaboteur, a new open-source extension for the Burp Suite security testing platform. Designed to assist security professionals in assessing the robustness of stateless authentication mechanisms, the tool automates the detection, editing, signing, and attacking of various signed web tokens, including JSON Web Tokens (JWT), Django, Flask, and Express tokens. SignSaboteur features automatic token detection within HTTP requests and WebSocket messages, along with built-in editors for JSON and hexadecimal strings. It includes prebuilt wordlists for default secret keys and salts, supporting brute-force attacks with configurable strategies ranging from fast to deep derivation techniques. The extension also facilitates authorization bypass attacks by injecting payloads into user claims and attempting to forge messages with default keys. This release aims to help developers and testers identify insecure configurations and prevent vulnerabilities such as authentication bypass and remote code execution. By streamlining the process of discovering secret keys and exploiting token structures, SignSaboteur enhances the efficiency of web application security assessments.
Wire timeline
PortSwigger Releases SignSaboteur: A Burp Suite Extension for Forging Signed Web Tokens
PortSwigger Research has introduced SignSaboteur, a new open-source extension for the Burp Suite security testing platform. Designed to assist security professionals in assessing the robustness of stateless authentication mechanisms, the tool automates the detection, editing, signing, and attacking of various signed web tokens, including JSON Web Tokens (JWT), Django, Flask, and Express tokens. SignSaboteur features automatic token detection within HTTP requests and WebSocket messages, along with built-in editors for JSON and hexadecimal strings. It includes prebuilt wordlists for default secret keys and salts, supporting brute-force attacks with configurable strategies ranging from fast to deep derivation techniques. The extension also facilitates authorization bypass attacks by injecting payloads into user claims and attempting to forge messages with default keys. This release aims to help developers and testers identify insecure configurations and prevent vulnerabilities such as authentication bypass and remote code execution. By streamlining the process of discovering secret keys and exploiting token structures, SignSaboteur enhances the efficiency of web application security assessments.
PortSwigger Research