Support For XXE Attacks In SAML In Our Burp Suite Extension

In this post we present the new version of the Burp Suite extension EsPReSSO - Extension for Processing and Recognition of Single Sign-On Protocols. A DTD attacker was implemented on SAML services that was based on the DTD Cheat Sheet by the Chair for Network and Data Security (https://web-in-security.blogspot.de/2016/03/xxe-cheat-sheet.html). In addition, many fixes were added and a new SAML editor was merged. You can find the newest version release here: https://github.com/RUB-NDS/BurpSSOExtension/releases/tag/v3.1

New SAML editor

Before the new release, EsPReSSO had a simple SAML editor where the decoded SAML messages could be modified by the user. We extended the SAML editor so that the user has the possibility to define the encoding of the SAML message and to select their HTTP binding (HTTP-GET or HTTP-POST).

Redesigned SAML Encoder/Decoder

Enhancement of the SAML attacker

XML Signature Wrapping and XML Signature Faking attacks have already been part of the previous EsPReSSO version. Now the user can also perform DTD attacks! The user can select from 18 different attack vectors and manually refine them all before applying the change to the original message. Additional attack vectors can also be added by extending the XML config file of the DTD attacker.
The DTD attacker can also be started in a fully automated mode. This functionality is integrated in the BurpSuite Intruder.

DTD Attacker for SAML messages

Supporting further attacks

We implemented a CertificateViewer which extracts and decodes the certificates contained within the SAML tokens. In addition, a user interface for executing SignatureExclusion attack on SAML has been implemented.

Additional functions will follow in later versions.

Currently we are working on XML Encryption attacks.

This is a combined work from Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, and Vladislav Mladenov.

The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

Related news

1. Hacker Tools For Windows
2. Hacker Tools Mac
3. Install Pentest Tools Ubuntu
4. Pentest Tools Subdomain
5. Hacks And Tools
6. Hacker Tools Apk Download
7. Hacking Tools Pc
8. Pentest Tools Online
9. Pentest Tools
10. Hackers Toolbox
11. New Hack Tools
12. Hacker Tools For Mac
13. How To Install Pentest Tools In Ubuntu
14. Hack Tool Apk
15. Top Pentest Tools
16. Tools 4 Hack
17. Tools Used For Hacking
18. Wifi Hacker Tools For Windows
19. Pentest Reporting Tools
20. Best Hacking Tools 2019
21. Pentest Tools For Windows
22. Hacker Tools Linux
23. Hacker Tools For Mac
24. Pentest Tools Free
25. Hacking Tools And Software
26. Underground Hacker Sites
27. Nsa Hack Tools
28. Android Hack Tools Github
29. Hack Tool Apk
30. Hak5 Tools
31. Nsa Hacker Tools
32. Wifi Hacker Tools For Windows
33. Hack Tools
34. What Are Hacking Tools
35. Top Pentest Tools
36. Pentest Tools For Android
37. Pentest Box Tools Download
38. Best Hacking Tools 2019
39. Underground Hacker Sites
40. Hacker Hardware Tools
41. Tools For Hacker
42. Hacker Tools For Mac
43. Hacks And Tools
44. Hacks And Tools
45. Hack Tools For Ubuntu
46. New Hack Tools
47. How To Make Hacking Tools
48. Best Pentesting Tools 2018
49. Hack Tool Apk No Root
50. Hacking Tools 2019
51. Pentest Tools Port Scanner
52. Pentest Tools Free
53. Hacker Tools Free Download
54. Hack Tools Online
55. Pentest Tools Free
56. Pentest Tools Alternative
57. Tools Used For Hacking
58. Pentest Box Tools Download
59. Hackers Toolbox
60. Hacking Tools Usb
61. Pentest Tools Android
62. Pentest Tools For Ubuntu
63. Hacker Hardware Tools
64. Hacking Tools Github
65. Hack Tools
66. Hack App
67. Pentest Tools Url Fuzzer
68. Top Pentest Tools
69. Kik Hack Tools
70. Hacking Tools For Kali Linux
71. Hacking Tools 2019
72. Hacking Tools Mac
73. Hacking Tools Usb
74. Pentest Tools Website Vulnerability
75. Kik Hack Tools
76. Hacking Tools Free Download
77. Hacking Tools Github
78. Pentest Tools Port Scanner
79. Game Hacking
80. Pentest Tools Website
81. Pentest Tools List
82. Blackhat Hacker Tools
83. Pentest Tools Review