https://github.com/RobinFassina-Moschini/Burp-WS-Security

https://github.com/RobinFassina-Moschini/Burp-WS-Security

Last synced: 2 months ago
JSON representation

• Host: GitHub
• URL: https://github.com/RobinFassina-Moschini/Burp-WS-Security
• Owner: RobinFassina-Moschini
• License: gpl-3.0
• Created: 2019-12-06T15:27:47.000Z (about 5 years ago)
• Default Branch: master
• Last Pushed: 2019-12-11T15:53:06.000Z (about 5 years ago)
• Last Synced: 2024-08-02T00:23:10.799Z (6 months ago)
• Language: Java
• Size: 3.84 MB
• Stars: 0
• Watchers: 1
• Forks: 5
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-burp-extensions - Burp WS-Security - This extension calculate a valid WS security token for every request (In Proxy, Scanner, Intruder, Repeater, Sequencer, Extender), and replace variables in theses requests by the valid token. (Web Services / SSRF)

README

        
# Burp WS-Security

This extension calculate a valid WS security token for every request (In Proxy, Scanner, Intruder, Repeater, Sequencer, Extender), and replace variables in theses requests by the valid token.

It follow Web Services Security (WS-Security, WSS) published by OASIS

## Using Burp WS-Security

This extension only change requests targeting in scope item. So you need to add the target in the scope.


Go to the WSSecurity tab, fill the password field, choose if you need the nonce to be base64 encoded or not.


Click “Turn WS-Security ON”. Now, for every request in scope, a valid security token will be created.


In your request 


#WS-SecurityPasswordDigest will be replaced by the Password Digest



#WS-SecurityNonce will be replaced by the Nonce



#WS-SecurityCreated will be replaced by the correct time



#WS-SecurityUUID will be replaced by a random UUID



This extension will log in the Extender UI every request after change if you need to debug.


![Screenshot](https://raw.githubusercontent.com/RobinFassina-Moschini/Burp-WS-Security/master/images/screenshot.png)