This extension processes and recognizes single sign-on protocols.
2 | 3 |Detecting
4 |Supported Protocols:
5 |Attacking
16 |Beautifier
23 |Editors/Viewers
31 |33 | 34 | 35 | -------------------------------------------------------------------------------- /src/main/java/de/rub/nds/burp/espresso/gui/attacker/saml/UISigWrapAttack.java: -------------------------------------------------------------------------------- 1 | /** 2 | * EsPReSSO - Extension for Processing and Recognition of Single Sign-On Protocols. 3 | * Copyright (C) 2015 Tim Guenther and Christian Mainka 4 | * 5 | * This program is free software; you can redistribute it and/or modify it under 6 | * the terms of the GNU General Public License as published by the Free Software 7 | * Foundation; either version 2 of the License, or (at your option) any later 8 | * version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT 11 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS 12 | * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more 13 | * details. 14 | * 15 | * You should have received a copy of the GNU General Public License along with 16 | * this program; if not, write to the Free Software Foundation, Inc., 51 17 | * Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. 18 | */ 19 | package de.rub.nds.burp.espresso.gui.attacker.saml; 20 | 21 | import de.rub.nds.burp.espresso.gui.attacker.saml.xsw.UISigWrapAttackInit; 22 | import de.rub.nds.burp.espresso.gui.attacker.saml.xsw.UISigWrapExec; 23 | import de.rub.nds.burp.utilities.listeners.CodeListenerController; 24 | import javax.swing.JTabbedPane; 25 | 26 | /** 27 | * The Signature Wrapping Attack 28 | * @author Nurullah Erinola 29 | * @version 1.0 30 | */ 31 | public class UISigWrapAttack extends JTabbedPane { 32 | 33 | private final String INIT = "Init Attack"; 34 | private final String EXECUTE = "Execute Attack"; 35 | 36 | private UISigWrapAttackInit uiInit; 37 | private UISigWrapExec uiExec; 38 | 39 | /** 40 | * Create new form UISigWrapAttackNew. 41 | */ 42 | public UISigWrapAttack(){ 43 | initComponents(); 44 | } 45 | 46 | private void initComponents() { 47 | uiExec = new UISigWrapExec(); 48 | uiInit = new UISigWrapAttackInit(uiExec); 49 | uiInit.setSwitchTabFunc((Integer i) -> selectTab(i)); 50 | // Add to pane 51 | this.add(INIT, uiInit); 52 | this.add(EXECUTE, uiExec); 53 | } 54 | 55 | /** 56 | * Set the listener for the editor. 57 | * @param listeners {@link de.rub.nds.burp.utilities.listeners.CodeListenerController} 58 | */ 59 | public void setListeners(CodeListenerController listeners){ 60 | uiInit.setListener(listeners); 61 | uiExec.setListener(listeners); 62 | } 63 | 64 | private void selectTab(int index) { 65 | this.setSelectedIndex(index); 66 | } 67 | } 68 | -------------------------------------------------------------------------------- /src/main/java/de/rub/nds/burp/espresso/gui/attacker/util/PayloadBean.java: -------------------------------------------------------------------------------- 1 | /** 2 | * EsPReSSO - Extension for Processing and Recognition of Single Sign-On Protocols. 3 | * Copyright (C) 2015 Tim Guenther and Christian Mainka 4 | * 5 | * This program is free software; you can redistribute it and/or modify it under 6 | * the terms of the GNU General Public License as published by the Free Software 7 | * Foundation; either version 2 of the License, or (at your option) any later 8 | * version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT 11 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS 12 | * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more 13 | * details. 14 | * 15 | * You should have received a copy of the GNU General Public License along with 16 | * this program; if not, write to the Free Software Foundation, Inc., 51 17 | * Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. 18 | */ 19 | package de.rub.nds.burp.espresso.gui.attacker.util; 20 | 21 | import java.beans.PropertyChangeListener; 22 | import java.beans.PropertyChangeSupport; 23 | import wsattacker.library.signatureWrapping.option.Payload; 24 | 25 | /** 26 | * PayloadBean 27 | * @author Christian Mainka 28 | * @version 1.0 29 | */ 30 | 31 | public class PayloadBean { 32 | 33 | private Payload payload; 34 | 35 | /** 36 | * Property of payload. 37 | */ 38 | public static final String PROP_PAYLOAD = "payload"; 39 | 40 | private transient final PropertyChangeSupport propertyChangeSupport = new PropertyChangeSupport(this); 41 | 42 | /** 43 | * Get the value of payload 44 | * 45 | * @return the value of payload 46 | */ 47 | public Payload getPayload() { 48 | return payload; 49 | } 50 | 51 | /** 52 | * Set the value of payload 53 | * 54 | * @param payload new value of payload 55 | */ 56 | public void setPayload(Payload payload) { 57 | Payload oldPayload = this.payload; 58 | this.payload = payload; 59 | propertyChangeSupport.firePropertyChange(PROP_PAYLOAD, oldPayload, payload); 60 | } 61 | 62 | /** 63 | * Add PropertyChangeListener. 64 | * 65 | * @param listener {@link java.beans.PropertyChangeListener} 66 | */ 67 | public void addPropertyChangeListener(PropertyChangeListener listener) { 68 | propertyChangeSupport.addPropertyChangeListener(listener); 69 | } 70 | 71 | /** 72 | * Remove PropertyChangeListener. 73 | * 74 | * @param listener {@link java.beans.PropertyChangeListener} 75 | */ 76 | public void removePropertyChangeListener(PropertyChangeListener listener) { 77 | propertyChangeSupport.removePropertyChangeListener(listener); 78 | } 79 | 80 | } -------------------------------------------------------------------------------- /src/main/java/de/rub/nds/burp/espresso/gui/UIMain.java: -------------------------------------------------------------------------------- 1 | /** 2 | * EsPReSSO - Extension for Processing and Recognition of Single Sign-On Protocols. 3 | * Copyright (C) 2015 Tim Guenther and Christian Mainka 4 | * 5 | * This program is free software; you can redistribute it and/or modify it under 6 | * the terms of the GNU General Public License as published by the Free Software 7 | * Foundation; either version 2 of the License, or (at your option) any later 8 | * version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT 11 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS 12 | * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more 13 | * details. 14 | * 15 | * You should have received a copy of the GNU General Public License along with 16 | * this program; if not, write to the Free Software Foundation, Inc., 51 17 | * Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. 18 | */ 19 | package de.rub.nds.burp.espresso.gui; 20 | 21 | import burp.IBurpExtenderCallbacks; 22 | import javax.swing.JTabbedPane; 23 | 24 | /** 25 | * The main window, the parent window for all tabs. 26 | * @author Tim Guenther 27 | * @version 1.0 28 | */ 29 | public class UIMain extends JTabbedPane{ 30 | private IBurpExtenderCallbacks callbacks; 31 | 32 | //GUI 33 | private UIHistory history; 34 | private UIOptions options; 35 | private UIHelp help; 36 | 37 | /** 38 | * Construct the main UI. 39 | * @param callbacks {@link burp.IBurpExtenderCallbacks}. 40 | */ 41 | public UIMain(IBurpExtenderCallbacks callbacks) { 42 | this.callbacks = callbacks; 43 | initComponents(); 44 | 45 | } 46 | /** 47 | * 48 | * @return Get the history tab. 49 | */ 50 | public UIHistory getHistory(){ 51 | return history; 52 | } 53 | 54 | /** 55 | * 56 | * @return Get the help tab. 57 | */ 58 | public UIHelp getHelp() { 59 | return help; 60 | } 61 | 62 | /** 63 | * 64 | * @return Get the options tab. 65 | */ 66 | public UIOptions getOptions() { 67 | return options; 68 | } 69 | 70 | private void initComponents(){ 71 | //register all components on the extension tab 72 | //sso history 73 | history = new UIHistory(callbacks); 74 | //options 75 | options = new UIOptions(callbacks); 76 | //help 77 | help = new UIHelp(); 78 | 79 | this.addTab("SSO History", history); 80 | this.addTab("Options", options); 81 | this.addTab("Help", help); 82 | 83 | // customize ui components 84 | callbacks.customizeUiComponent(this); 85 | } 86 | } 87 | -------------------------------------------------------------------------------- /src/main/java/de/rub/nds/burp/utilities/listeners/CodeListenerController.java: -------------------------------------------------------------------------------- 1 | /** 2 | * EsPReSSO - Extension for Processing and Recognition of Single Sign-On Protocols. 3 | * Copyright (C) 2015 Tim Guenther and Christian Mainka 4 | * 5 | * This program is free software; you can redistribute it and/or modify it under 6 | * the terms of the GNU General Public License as published by the Free Software 7 | * Foundation; either version 2 of the License, or (at your option) any later 8 | * version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT 11 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS 12 | * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more 13 | * details. 14 | * 15 | * You should have received a copy of the GNU General Public License along with 16 | * this program; if not, write to the Free Software Foundation, Inc., 51 17 | * Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. 18 | */ 19 | package de.rub.nds.burp.utilities.listeners; 20 | 21 | import javax.swing.event.EventListenerList; 22 | 23 | /** 24 | * CodeListener Controller 25 | * @author Tim Guenther 26 | * @version 1.0 27 | */ 28 | public class CodeListenerController { 29 | private EventListenerList listeners = new EventListenerList(); 30 | private CodeListenerControllerType type; 31 | 32 | /** 33 | * Default Constructor. 34 | * @param type 35 | */ 36 | public CodeListenerController(CodeListenerControllerType type){ 37 | this.type = type; 38 | } 39 | 40 | /** 41 | * Return the type of the listener {@link de.rub.nds.burp.utilities.listeners.ICodeListener} 42 | * @return The type of the listener. 43 | */ 44 | public CodeListenerControllerType getType() { 45 | return type; 46 | } 47 | 48 | /** 49 | * Add a new implementation of {@link de.rub.nds.burp.utilities.listeners.ICodeListener} 50 | * @param listener The new listener. 51 | */ 52 | public void addCodeListener(ICodeListener listener){ 53 | listeners.add(ICodeListener.class, listener); 54 | } 55 | 56 | /** 57 | * Remove the {@link de.rub.nds.burp.utilities.listeners.ICodeListener} 58 | * @param listener The listener to remove. 59 | */ 60 | public void removeCodeListener(ICodeListener listener){ 61 | listeners.remove(ICodeListener.class, listener); 62 | } 63 | 64 | /** 65 | * Notify all registered listeners with the new code. 66 | * @param event The event. 67 | */ 68 | public synchronized void notifyAll(AbstractCodeEvent event) 69 | { 70 | for (ICodeListener l : listeners.getListeners(ICodeListener.class)){ 71 | l.setCode(event); 72 | } 73 | } 74 | 75 | 76 | } 77 | -------------------------------------------------------------------------------- /src/main/java/de/rub/nds/burp/espresso/gui/attacker/UIError.form: -------------------------------------------------------------------------------- 1 | 2 | 3 | 56 | -------------------------------------------------------------------------------- /src/test/java/de/rub/nds/burp/utilities/table/TableTest.java: -------------------------------------------------------------------------------- 1 | /** 2 | * EsPReSSO - Extension for Processing and Recognition of Single Sign-On Protocols. 3 | * Copyright (C) 2015 Tim Guenther and Christian Mainka 4 | * 5 | * This program is free software; you can redistribute it and/or modify it under 6 | * the terms of the GNU General Public License as published by the Free Software 7 | * Foundation; either version 2 of the License, or (at your option) any later 8 | * version. 9 | * 10 | * This program is distributed in the hope that it will be useful, but WITHOUT 11 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS 12 | * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more 13 | * details. 14 | * 15 | * You should have received a copy of the GNU General Public License along with 16 | * this program; if not, write to the Free Software Foundation, Inc., 51 17 | * Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. 18 | */ 19 | package de.rub.nds.burp.utilities.table; 20 | 21 | import de.rub.nds.burp.utilities.table.ssoHistory.TableHelper; 22 | import de.rub.nds.burp.utilities.table.ssoHistory.Table; 23 | import de.rub.nds.burp.utilities.table.ssoHistory.TableEntry; 24 | import java.util.ArrayList; 25 | import junit.framework.TestCase; 26 | 27 | /** 28 | * 29 | * @author Tim Guenther 30 | */ 31 | public class TableTest extends TestCase { 32 | 33 | public TableTest(String testName) { 34 | super(testName); 35 | } 36 | 37 | /** 38 | * Test of getName method, of class Table. 39 | */ 40 | public void testGetName() { 41 | System.out.println("getName"); 42 | String expResult = "testName"; 43 | Table instance = new Table(new TableHelper(null), expResult, "123"); 44 | String result = instance.getName(); 45 | assertTrue(expResult.equals(result)); 46 | } 47 | 48 | /** 49 | * Test of getTableHelper method, of class Table. 50 | */ 51 | public void testGetTableHelper() { 52 | System.out.println("getTableHelper"); 53 | TableHelper expResult = new TableHelper(null); 54 | Table instance = new Table(expResult, null, "123"); 55 | TableHelper result = instance.getTableHelper(); 56 | assertEquals(expResult, result); 57 | // TODO review the generated test code and remove the default call to fail. 58 | //fail("The test case is a prototype."); 59 | } 60 | 61 | /** 62 | * Test of getTableList method, of class Table. 63 | */ 64 | public void testGetTableList() { 65 | System.out.println("getTableList"); 66 | ArrayList