WS Security

Generates WS-Security UsernameToken values on the fly and inserts them into SOAP requests, so you can test web services that require a fresh password digest, nonce and timestamp on every request.

Features

• Test WS-Security protected services without manually recalculating tokens: every in-scope request gets a freshly generated, valid token.
• Works across Proxy, Scanner, Intruder, Repeater, Sequencer and Extender, so replayed and automated requests are not rejected for stale or reused tokens.
• Simple placeholder syntax lets you drop the token values anywhere in a request body or header.
• Supports both plaintext and hashed passwords (SHA-1, SHA-256 or MD5), and Base64-encoded or plain nonces, to match the target service's configuration.
• Configurable nonce length.
• Only modifies requests to in-scope targets, so out-of-scope traffic is left untouched.
• Logs each modified request to the extension output to help you debug token problems.

Usage

1. Add the target to the Burp scope. Only in-scope requests are modified.
2. Insert the placeholders where the values are needed in your request:
   • #WS-SecurityPasswordDigest is replaced with the password digest
   • #WS-SecurityNonce is replaced with the nonce
   • #WS-SecurityCreated is replaced with the current timestamp
   • #WS-SecurityUUID is replaced with a random UUID
3. Open the WSSecurity tab and enter the password. Choose whether the nonce is Base64 encoded and set its size.
4. If the service expects a hashed password, enable the password hashing option under the advanced options and select the hash algorithm.
5. Click Turn WS-Security on. Every in-scope request now has its placeholders replaced with newly generated values.