BappDescription.html

<p>
    Generates WS-Security UsernameToken values on the fly and inserts them into SOAP requests, so you can test web
    services that require a fresh password digest, nonce and timestamp on every request.
</p>

<h2>Features</h2>
<ul>
    <li>Test WS-Security protected services without manually recalculating tokens: every in-scope request gets a freshly
        generated, valid token.</li>
    <li>Works across Proxy, Scanner, Intruder, Repeater, Sequencer and Extender, so replayed and automated requests are
        not rejected for stale or reused tokens.</li>
    <li>Simple placeholder syntax lets you drop the token values anywhere in a request body or header.</li>
    <li>Supports both plaintext and hashed passwords (SHA-1, SHA-256 or MD5), and Base64-encoded or plain nonces, to
        match the target service's configuration.</li>
    <li>Configurable nonce length.</li>
    <li>Only modifies requests to in-scope targets, so out-of-scope traffic is left untouched.</li>
    <li>Logs each modified request to the extension output to help you debug token problems.</li>
</ul>

<h2>Usage</h2>
<ol>
    <li>Add the target to the Burp scope. Only in-scope requests are modified.</li>
    <li>Insert the placeholders where the values are needed in your request:
        <ul>
            <li><code class="InlineCode">#WS-SecurityPasswordDigest</code> is replaced with the password digest</li>
            <li><code class="InlineCode">#WS-SecurityNonce</code> is replaced with the nonce</li>
            <li><code class="InlineCode">#WS-SecurityCreated</code> is replaced with the current timestamp</li>
            <li><code class="InlineCode">#WS-SecurityUUID</code> is replaced with a random UUID</li>
        </ul>
    </li>
    <li>Open the WSSecurity tab and enter the password. Choose whether the nonce is Base64 encoded and set its size.
    </li>
    <li>If the service expects a hashed password, enable the password hashing option under the advanced options and
        select the hash algorithm.</li>
    <li>Click Turn WS-Security on. Every in-scope request now has its placeholders replaced with newly generated values.
    </li>
</ol>