Collected research
Introducing SignSaboteur: forge signed web tokens with ease
Signed web tokens beyond JWT, including the session formats used by Django, Flask, Express and Rails, are widely deployed with default or leaked signing secrets, and their bespoke encodings make them easy to overlook during testing. This article presents SignSaboteur, an open-source Burp Suite extension that detects, edits, re-signs and brute-forces such tokens in requests and WebSocket messages, and sets out a methodology for turning a recovered secret into an authorisation bypass.
Record
- Researcher
- Zakhar Fedotkin
- Published by
- PortSwigger Research
- Date
- Topic
- Other
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Zakhar Fedotkin, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .