Support For XXE Attacks In SAML In Our Burp Suite Extension

In this post we present the new version of the Burp Suite extension EsPReSSO - Extension for Processing and Recognition of Single Sign-On Protocols. A DTD attacker was implemented on SAML services that was based on the DTD Cheat Sheet by the Chair for Network and Data Security (https://web-in-security.blogspot.de/2016/03/xxe-cheat-sheet.html). In addition, many fixes were added and a new SAML editor was merged. You can find the newest version release here: https://github.com/RUB-NDS/BurpSSOExtension/releases/tag/v3.1

New SAML editor

Before the new release, EsPReSSO had a simple SAML editor where the decoded SAML messages could be modified by the user. We extended the SAML editor so that the user has the possibility to define the encoding of the SAML message and to select their HTTP binding (HTTP-GET or HTTP-POST).

Redesigned SAML Encoder/Decoder

Enhancement of the SAML attacker

XML Signature Wrapping and XML Signature Faking attacks have already been part of the previous EsPReSSO version. Now the user can also perform DTD attacks! The user can select from 18 different attack vectors and manually refine them all before applying the change to the original message. Additional attack vectors can also be added by extending the XML config file of the DTD attacker.
The DTD attacker can also be started in a fully automated mode. This functionality is integrated in the BurpSuite Intruder.

DTD Attacker for SAML messages

Supporting further attacks

We implemented a CertificateViewer which extracts and decodes the certificates contained within the SAML tokens. In addition, a user interface for executing SignatureExclusion attack on SAML has been implemented.

Additional functions will follow in later versions.

Currently we are working on XML Encryption attacks.

This is a combined work from Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, and Vladislav Mladenov.

The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

Continue reading

• Hacker Tools Software
• Hacker Tools Mac
• Hacking Tools For Windows
• Pentest Tools For Android
• Tools Used For Hacking
• Hacking App
• Hak5 Tools
• Game Hacking
• Hack And Tools
• Pentest Tools Online
• Hacking Tools And Software
• Hacking Tools Github
• Hacking Tools Name
• Hacker Tools For Ios
• Github Hacking Tools
• Hacking Tools Name
• Hacking Tools For Windows
• Pentest Tools Kali Linux
• Hacking Tools For Windows 7
• Hacks And Tools
• Pentest Tools Website
• Hacker Tools Github
• Computer Hacker
• Hack Tools Github
• Hacker Tools For Ios
• Hack Tools Pc
• Blackhat Hacker Tools
• Hacking Tools Hardware
• Pentest Tools Port Scanner
• Hacking Tools Kit
• Hacker Tools For Mac
• Best Hacking Tools 2020
• Pentest Tools
• Hacking Tools Windows 10
• Wifi Hacker Tools For Windows
• Pentest Tools Kali Linux
• Pentest Tools Website
• Hack Tool Apk
• Hacking Apps
• Pentest Tools Website Vulnerability
• Pentest Tools Nmap
• Hacker Tools 2020
• Hacker Tools List
• Hacker Tools Github
• Hacker Tools Hardware
• Hacks And Tools
• Pentest Tools List
• Hack Tools For Games
• Hacker Tools Apk Download
• Hacking Apps
• Hacking Tools Usb
• Hacking Tools Usb
• Pentest Tools Nmap
• Pentest Tools Linux
• Beginner Hacker Tools
• Hacking Tools Software
• Hack Apps
• Hacking Tools Hardware
• Android Hack Tools Github
• Hacker Tools Free Download
• Pentest Tools Port Scanner
• Beginner Hacker Tools
• Pentest Tools Find Subdomains
• Best Hacking Tools 2020
• Pentest Tools Android
• Hack Tools For Pc
• Hacker Tools Free