Support For XXE Attacks In SAML In Our Burp Suite Extension

In this post we present the new version of the Burp Suite extension EsPReSSO - Extension for Processing and Recognition of Single Sign-On Protocols. A DTD attacker was implemented on SAML services that was based on the DTD Cheat Sheet by the Chair for Network and Data Security (https://web-in-security.blogspot.de/2016/03/xxe-cheat-sheet.html). In addition, many fixes were added and a new SAML editor was merged. You can find the newest version release here: https://github.com/RUB-NDS/BurpSSOExtension/releases/tag/v3.1

New SAML editor

Before the new release, EsPReSSO had a simple SAML editor where the decoded SAML messages could be modified by the user. We extended the SAML editor so that the user has the possibility to define the encoding of the SAML message and to select their HTTP binding (HTTP-GET or HTTP-POST).

Redesigned SAML Encoder/Decoder

Enhancement of the SAML attacker

XML Signature Wrapping and XML Signature Faking attacks have already been part of the previous EsPReSSO version. Now the user can also perform DTD attacks! The user can select from 18 different attack vectors and manually refine them all before applying the change to the original message. Additional attack vectors can also be added by extending the XML config file of the DTD attacker.
The DTD attacker can also be started in a fully automated mode. This functionality is integrated in the BurpSuite Intruder.

DTD Attacker for SAML messages

Supporting further attacks

We implemented a CertificateViewer which extracts and decodes the certificates contained within the SAML tokens. In addition, a user interface for executing SignatureExclusion attack on SAML has been implemented.

Additional functions will follow in later versions.

Currently we are working on XML Encryption attacks.

This is a combined work from Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, and Vladislav Mladenov.

The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

Continue reading

1. Hacks And Tools
2. Pentest Tools Subdomain
3. Pentest Recon Tools
4. New Hack Tools
5. Best Hacking Tools 2020
6. Hacker Tools Software
7. Hack Tools 2019
8. Hacking Tools And Software
9. Hack Tools For Ubuntu
10. Hacking Tools Hardware
11. How To Make Hacking Tools
12. Pentest Tools Apk
13. Hacker Tools Windows
14. Hacking Tools And Software
15. Hacking Tools For Windows 7
16. Tools For Hacker
17. Game Hacking
18. Hacker Techniques Tools And Incident Handling
19. Hack Tools For Games
20. Hacking Tools Usb
21. Pentest Tools Tcp Port Scanner
22. Pentest Tools Online
23. Hack Tool Apk No Root
24. Pentest Tools Framework
25. Hacking Tools For Beginners
26. Pentest Tools Subdomain
27. Pentest Tools Open Source
28. Hacker
29. Pentest Tools For Ubuntu

Nikadema Bmc Kitchen

DOWNLOAD

What Daphne Saw, Short Film, Review And Interview.

What Daphne Saw is a poignant look at the criminal justice system. The is a well stated and slightly unnerving view of what has been spoken about in recent events in a way that, so many times, science fiction can only present.

Well done.

What Daphne Saw was screened at the 2019 FilmQuest film festival (website). It was nominated for Best Sci-Fi Short.

Synopsis

In the future, capital punishment has been abolished. Violent criminals are reprogrammed into unquestioning servants, their free will and ability to speak taken away. A young woman endures her punishment of silent servitude in a seemingly normal man's home, where she discovers dark secrets.

Tagline

Set in a dystopian future where criminals are reprogrammed to be voiceless, unquestioning servants to the wealthy, What Daphne Saw sheds light on the silencing of victims and asks the question, what does justice really mean?

Lizz Marshall directed What Daphne Saw and also shared some thoughts about her movie, inspirations, future and likes.

What was the inspiration for What Daphne Saw?

The concept for What Daphne Saw came from a few different things. It started with a feeling of voiclessness and powerlessness I saw in the character of Daphne in Greek mythology; there is a story where the God Apollo tries to rape a woman on Earth (Daphne) and when she begs the Gods for help, they turn her into a tree, so she is silenced for speaking out and forced to forever internalize her pain. I connected with Daphne in that story and wanted to explore that dynamic and those particular feelings. I had also done a short documentary my freshman year of college about recidivism, so my views on the justice system organically bled into the story.

What project(s) do you have coming up you're excited about?

As far as upcoming projects go: I will be working with anti-human trafficking non-profit organization NotInOurCity, who served as executive producers on What Daphne Saw, to create a genre-based VR short film that educates on human trafficking in a way that is engaging and narrative driven. They are currently raising funds for the project!

What was your early inspiration for pursuing a career in film?

Like many sci-fi filmmakers, Star Wars. I remember watching the original trilogy as a kid and feeling like it was just totally magical. It was really cool to be immersed in a different world and I really wanted to do that—build other worlds.

What would be your dream project?

I am hoping that this isn't the end for Daphne. I have a feature length version of What Daphne Saw that I am shopping around at the moment. I really want to direct the feature film for What Daphne Saw and share more of her world and complexities that there isn't enough time for in a short. There's also a project that's much more of a stretch that I'm hoping will one day see the light of day—it's a horror-comedy musical that's pretty out there. Totally in the opposite direction of What Daphne Saw tonally and a very different side of me as a writer. Those are my goals for the future right now!

What are some of your favorite pastimes when not working on a movie?

I also write music! I have made two music videos for songs called Parasiteand Lifeline I have co-written with Alex Winkler, who is the composer for What Daphne Saw. We actually co-wrote the song in the credits for the film—I wrote the lyrics and sang and Alex wrote the music. It was originally a song that we did loosely based on a video game called Life is Strange, and then made a music video for, but the emotional core of it really fit with the ending of What Daphne Saw so we decided to use it. I'm hoping we'll be able to release an EP at some point.

What is one of your favorite movies and why?

Empire Strikes Back! It's one of the few movies I can watch over and over and not get tired of.

You can watch the trailer on YouTube (link).

You can follow the movie on

Twitter and Instagram @whatdaphnesaw

Facebook (link)

Find out more about What Daphne Saw on IMDb (link).

I'm working at keeping my material free of subscription charges by supplementing costs by being an Amazon Associate and having advertising appear. I earn a fee when people make purchases of qualified products from Amazon when they enter the site from a link on Guild Master Gaming and when people click on an ad. If you do either, thank you.

If you have a comment, suggestion, or critique please leave a comment here or send an email to guildmastergaming@gmail.com.

I have articles being published by others and you can find most of them on Guild Master Gaming on Facebookand Twitter(@GuildMstrGmng).