search

ozzi- / JWT4B

JWT Support for Burp
GNU General Public License v3.0
240 stars 46 forks source link

Repeater/Intercept extension interface no longer available #75

Closed lanmaster53 closed 2 years ago

lanmaster53 commented 2 years ago

After the latest update, the JWT4B attack interface is no longer available in Repeater or Intercept.

virusvfv commented 2 years ago

Hi. Tell please more about this fail. Your burp version, how U installed this extension, and what error message it gives when loading (in Out / Error tabs in Burp Extender) ??? In my Burp (2022.5.1) release version of jar works well. Screenshot_2022-06-23_00-25-19

Screenshot_2022-06-23_00-31-28

lanmaster53 commented 2 years ago

I am using the package installer version of Burp Suite Pro 2022.5.1 (Stable) and Burp Suite Pro 2022.6 (Early Adopter) on a fully updated Mac OS Cataline 10.15.7. The extension is installed via the BApp store with no errors during loading.

I believe the issue to be the extension's recognition of the JWT. As you can see below, the JWT is sent in the Authorization header without the Bearer keyword. Perhaps the extension doesn't see this because of the way you recognize and parse JWTs. These requests aren't highlighted in the proxy history either. I can confirm that the extension does work properly when the Bearer keyword is present.

Screen_Shot_2022-06-23_at_9_39_41_AM-2
lanmaster53 commented 2 years ago

Looking in the JWT4B configuration, it appears that the detection triggers are configurable. I modified them and now it does indeed detect the token. I will close this issue. Thanks!