EsPReSSO

Extension for Processing and Recognition of Single Sign-On Protocols

The extension is based on the BurpSSO Extension, developed by the Chair of Network and Data Security, Ruhr University Bochum and the Hackmanit GmbH. The extension is part of a bachelor thesis by Tim Guenther at the Ruhr-University Bochum in cooperation with Context Information Security Ltd..

Features

Detecting

Supported Protocols:

• [x] SAML
• [x] OpenID
• [x] OAuth
• [x] BrowserId
• [x] OpenID Connect
• [x] Facebook Connect
• [x] Microsoft Account

Attacking

• [x] WS-Attacker integration while intercepting SAML messages
• [x] DTD-Attacker integration while intercepting SAML messages
• [x] XML-Encryption-Attacker integration while intercepting SAML messages

Beautifier

• [x] Syntax Highlight
• [x] Highlight SSO messages in proxy window and display the protocol type
• [x] Show all recognized SSO messages in a history tab
• [x] Context menu for 'Analyze SSO Protocol'

Editors/Viewers

• [x] View and edit SAML
• [x] View JSON and JSON Web Token (JWT)

Build

$ mvn clean package

(Please start Burp with Java 1.8)

Installation and Usage

• Build the JAR file as described above, or download it from releases.
• Load the JAR file from the target folder into Burp's Extender. (Start Burp with Java 1.8)
• SSO messages are highlighted automatically in Burp's HTTP history (Proxy tab).
• SAML, JSON and JWT editors and viewers attached automatically.
• A SSO History, Options and Help can be found in a new tab called 'EsPReSSO'.

Dependencies and Licences

Tested with:

• Java 1.8.0._151
• Burp Suite 1.7.36
• Ubuntu 16.04.3 LTS, amd64
• Netbeans 8.2
• Maven 3.3.9