WS Security
Summary: PortSwigger's BApp Store lists a Burp extension called WS Security, authored by Robin Fassina-Moschini at version 1.0a and last updated 10 February 2022, that generates WS-Security UsernameToken values on the fly and inserts them into SOAP requests. The extension is meant for testing web services that require a fresh password digest, nonce and timestamp on every request, and PortSwigger states that extensions are written by third-party users of Burp and come with no warranty of quality or usefulness.
What's compelling: SOAP services that demand a new digest, nonce and timestamp per request defeat replay-style testing unless the tooling regenerates those values, and this extension exists to fill that gap. It is third-party code last updated in February 2022, and PortSwigger explicitly disclaims any warranty on extensions, so the tooling your testers load into Burp carries that provenance.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026