Automatic Recognition, Processing and Attacking of Single Sign-On Protocols with Burp Suite Vladislav Mladenov, Tim Guenther, Christian Mainka, Horst-Görtz Institut für IT-Sicherheit, Ruhr-Universität Bochum 1 1
Single Sign-On Analyzing SSO EsPReSSO Demo 2
Single Sign-On Username/Password 3 User 3
Single Sign-On Service Provider 1 Service Provider 2 Identity Provider Username/ Password Token User Token Service Provider 3 Service Provider 4 Service Provider 5 4
Single Sign-On Analyzing SSO EsPReSSO Demo 5
Analyzing SSO: Protocols SAML 2.0 OpenID OAuth 2.0 MS Account Facebook Connect OpenID Connect 1.0 BrowserID 6
Analyzing SSO: Security issues 7
Analyzing SSO: Automated Analysis Start Results Pen-testing Tool Security auditor Server 8
Analyzing SSO: Automated Analysis Automated Analysis is insufficient Existing tools analyze only one SSO protocol or small subset of exisiting attacks Small deviations in the messages lead to false results Only known attacks are detected Extending the tools is insufficient or not possible Changes in the specification are not implemented Security report: No issues found There are no security issues? The tool did not find any security issues? 9
Analyzing SSO: Semi-automated Analysis Security pentester and researcher prefer semiautomated tools Full control over all messages Flexibility during security evaluations 10
Single Sign-On Analyzing SSO EsPReSSO Demo 12
Burp Suite Setup: Proxy HTTP Messages HTTP Request HTTP Response Burp Suite HTTP Request HTTP Response Security auditor Server 13
Burp Suite Many different messages. Hard to identify SSO related messages 14
EsPReSSO Acronym for Extension for Processing and Recognition of Single Sign-On Protocols Structure: Recognition Visualization Processing / Attacking 15
EsPReSSO: Recognition Burp Suite does not recognize SSO related messages by default SSO Messages are encoded with different technologies like: JSON JWT Compression Support for all previous presented protocols. 16
EsPReSSO: Visualization SSO History window, for SSO messages only. Special Editors for encoded messages. Syntax highlighting for: JSON XML (more possible) 17
EsPReSSO: Processing/Attacking XML Signature/Certificate Faking A signed XML message will be modified and signed with an new untrusted key XML Signature Wrapping A signed message will be modified without invalidating the provided signature 18
Single Sign-On Analyzing SSO EsPReSSO Demo 19
EsPReSSO: Conculsion A good basis to support pentesters and researchers during their work. EsPReSSO is still beta. Hopefully many feature requests and comments on GitHub. 20
Links Burp Suite https://portswigger.net/burp/ EsPReSSO https://github.com/rub-nds/burpssoextension 21
Any Questions? 22