Sign Saboteur, Web Token Signer
Summary: PortSwigger released SignSaboteur, a Burp Suite extension for editing, signing, verifying, and attacking signed tokens, supporting formats including Django TimestampSigner, ItsDangerous, Express cookie-session, OAuth2 Proxy, Tornado signed cookies, Ruby Rails signed and encrypted cookies, and Nimbus JOSE + JWT. The extension detects and edits tokens inline in HTTP requests, responses, and WebSocket messages, signs tokens with keys from its Keys View, brute-forces secrets using prebuilt wordlists drawn mostly from jwt-secrets, and implements eight authorization attacks against signed tokens.
Why it matters: A tool that automates brute-forcing signing secrets and runs eight known authorization attacks against signed tokens turns cookie and token forgery into a point-and-click exercise for anyone running Burp - so the strength of your signing keys and the validation logic behind them is now the only thing standing between an attacker and a forged session.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026