People Soft Token Extractor
Summary: PortSwigger's BApp Store lists a Burp extension, PeopleSoft Token Extractor, that analyzes Oracle PeopleSoft single sign-on tokens (PS_TOKEN) captured in requests, decoding the token data and supporting offline password recovery and token forgery for authorized testing of PeopleSoft SSO trust relationships. The extension was authored by Sayed Hamzah of Centurion Information Security, is version 1.0, was last updated 11 January 2018, and carries an overall system impact rating of Low.
What you should know: A public, third-party Burp extension has offered PS_TOKEN decoding, offline password recovery and token forgery since 2018, so any PeopleSoft SSO trust relationship that assumes its tokens are hard to abuse should be re-examined.
Read the original at PortSwigger Research ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026