Professional Community

Okta TOTP Authenticator

This extension generates time-based one-time passwords (TOTP) for Okta accounts and injects them into HTTP requests automatically. It is designed to integrate with session handling rules, allowing seamless security testing of Okta-enabled authentication flows.

Features

  • Handles automatic TOTP generation for Okta accounts using shared secrets.
  • Supports importing shared secrets via QR code or manual entry.
  • Displays the current TOTP code in the UI, refreshing every 30 seconds.
  • Uses a configurable regex pattern to locate TOTP placeholders in requests (default: (?<![\w\d])\d{6,8}(?![\w\d])).
  • Integrates with session handling rules to automate TOTP injection in tools like Scanner and Repeater.

Usage

  1. Open the extension's tab and either import a QR code or manually enter the shared secret in the 'Shared Secret' field, then click 'Update'.
  2. Customize the regex pattern in the UI, if needed, to match TOTP locations in requests.
  3. Go to "Settings -> Sessions" and create a new session handling rule.
  4. In "Rule actions", add "Invoke a Burp extension" and select "Okta TOTP Handler" from the dropdown list.
  5. In the "Scope" tab, check appropriate tools and configure the URL scope.
  6. Perform security testing against Okta-protected targets with TOTP automatically handled.

Author

Author

Ganesh2183

Version

Version

1.0.0

Rating

Rating

Popularity

Popularity

Last updated

Last updated

05 June 2025

Estimated system impact

Estimated system impact

Overall impact: Empty

Memory
Empty
CPU
Empty
General
Empty
Scanner
Empty

You can install BApps directly within Burp, via the BApp Store feature in the Burp Extender tool. You can also download them from here, for offline installation into Burp.

You can view the source code for all BApp Store extensions on our GitHub page.

Follow @BApp_Store on Twitter to receive notifications of all BApp releases and updates.

Please note that extensions are written by third party users of Burp, and PortSwigger Web Security makes no warranty about their quality or usefulness for any particular purpose.

Go back to BappStore

Note:

Please note that extensions are written by third party users of Burp, and PortSwigger Web Security makes no warranty about their quality or usefulness for any particular purpose.