# Introducing SignSaboteur: forge signed web tokens with ease

DevFeed: [Introducing SignSaboteur: forge signed web tokens with ease](<https://devfeed.tech/articles/introducing-signsaboteur-forge-signed-web-tokens-with-ease-7685.md>)

Original publisher: [Read original article](<https://portswigger.net/research/introducing-signsaboteur-forge-signed-web-tokens-with-ease>)

Author: Zakhar Fedotkin

Published: 2024-05-22T12:37:00Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [Security](<https://devfeed.tech/topics/security.md>), [Extension](<https://devfeed.tech/topics/extension.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Automation](<https://devfeed.tech/topics/automation.md>), [JSON](<https://devfeed.tech/topics/json.md>), [servers](<https://devfeed.tech/topics/servers.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [automation](<https://devfeed.tech/tags/automation.md>), [code](<https://devfeed.tech/tags/code.md>), [extension](<https://devfeed.tech/tags/extension.md>), [http](<https://devfeed.tech/tags/http.md>), [json](<https://devfeed.tech/tags/json.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [storage](<https://devfeed.tech/tags/storage.md>), [tokens](<https://devfeed.tech/tags/tokens.md>), [web](<https://devfeed.tech/tags/web.md>)

## AI overview

This article introduces SignSaboteur, an open source Burp Suite extension for editing, signing, verifying, and attacking signed web tokens. It supports token types including Django, Flask, and Express, detects tokens in HTTP and WebSocket messages, and automates secret-key brute-force and authorization-bypass attacks.

## Source excerpt

Signed web tokens are widely used for stateless authentication and authorization throughout the web. The most popular format is JSON Web Tokens (JWT) which we've already covered in depth, but beyond t