Redsys PSD2 Request Signer
Summary: A Burp Suite extension called Redsys PSD2 Request Signer, authored by migue27au at version 2.0.0 and last updated 30 April 2026, automatically signs outgoing requests to the Redsys PSD2 API by computing and injecting the required cryptographic headers. The extension removes the need to manually calculate signature values during testing, and PortSwigger notes that extensions are written by third-party users of Burp and come with no warranty of quality or usefulness.
What's compelling: Payment API testing often stalls on signature computation, and a third-party extension that injects cryptographic headers into live Redsys PSD2 traffic is code PortSwigger explicitly does not vouch for - so the question is who reviews it before it runs against production-adjacent payment endpoints.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026