Introducing Sign Saboteur: forge signed web tokens with ease
Summary: PortSwigger Research released SignSaboteur, an open source Burp Suite extension that edits, signs, verifies, and attacks signed web tokens including Django, Flask, and Express formats, with automatic detection and in-line editing of tokens in HTTP request/response pairs and WebSocket messages. The extension ships prebuilt word lists of known default secret keys and salts, supports brute force modes including a Deep mode for slow hashing functions like PBKDF2, and includes an unknown signed strings mode that looks for patterns matching the size of common hashing functions.
Why it matters: The tool automates finding secret keys that leak through source code, configuration files, documentation pages, and error messages - and once a key is found, it runs authorization bypass attacks, so any token signed with a default or disclosed secret is effectively forgeable.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026