From edc8292d9951cb69bae38c8f88aa3078d7c438ae Mon Sep 17 00:00:00 2001 From: Adam Piper Date: Sun, 8 Jan 2017 11:30:08 +0900 Subject: [PATCH 1/3] Add BApp metadata files. --- BappDescription.html | 29 +++++++++++++++++++++++++++++ BappManifest.bmf | 11 +++++++++++ 2 files changed, 40 insertions(+) create mode 100644 BappDescription.html create mode 100644 BappManifest.bmf diff --git a/BappDescription.html b/BappDescription.html new file mode 100644 index 0000000..8f57760 --- /dev/null +++ b/BappDescription.html @@ -0,0 +1,29 @@ +

SAML Raider is a Burp Suite extension for testing SAML infrastructures. It contains two core features - a SAML message editor and an X.509 certificate manager.

+

The message editor provides the following capabilities:

+ + +

The certificate manager provides the following capabilities:

+ \ No newline at end of file diff --git a/BappManifest.bmf b/BappManifest.bmf new file mode 100644 index 0000000..53a4602 --- /dev/null +++ b/BappManifest.bmf @@ -0,0 +1,11 @@ +Uuid: c61cfa893bb14db4b01775554f7b802e +ExtensionType: 1 +Name: SAML Raider +ScreenVersion: 1.2.1 +SerialVersion: 4 +MinPlatformVersion: 0 +ProOnly: False +Author: Roland Bischofberger / Emanuel Duss +ShortDescription: Provides a SAML message editor and a certificate management tool to help with testing SAML infrastructures. +EntryPoint: target/saml-raider-1.2.1-SNAPSHOT-jar-with-dependencies.jar +BuildCommand: mvn package -DskipTests=true -Dmaven.javadoc.skip=true -B From 7a9ff3181a8281176c4613df896a28d7c9db758d Mon Sep 17 00:00:00 2001 From: Adam Piper Date: Mon, 13 Feb 2017 21:41:18 +0900 Subject: [PATCH 2/3] Add RepoName to BappManifest --- BappManifest.bmf | 1 + 1 file changed, 1 insertion(+) diff --git a/BappManifest.bmf b/BappManifest.bmf index 53a4602..2962b91 100644 --- a/BappManifest.bmf +++ b/BappManifest.bmf @@ -1,6 +1,7 @@ Uuid: c61cfa893bb14db4b01775554f7b802e ExtensionType: 1 Name: SAML Raider +RepoName: saml-raider ScreenVersion: 1.2.1 SerialVersion: 4 MinPlatformVersion: 0 From 69844d1dc883de2ae8142d2282c5c0cc1e9a2edd Mon Sep 17 00:00:00 2001 From: Paul Johnston Date: Tue, 26 Mar 2019 16:01:54 +0000 Subject: [PATCH 3/3] Include javax.xml so extension works on OpenJDK 11 --- .gitignore | 2 ++ BappManifest.bmf | 6 +++--- pom.xml | 16 +++++++++++++--- .../application/BurpCertificateBuilder.java | 4 +--- src/main/java/helpers/XMLHelpers.java | 10 +++++----- src/main/java/model/BurpCertificateStore.java | 9 +++++---- src/test/java/application/HTTPHelpersTest.java | 17 +++++++---------- 7 files changed, 36 insertions(+), 28 deletions(-) diff --git a/.gitignore b/.gitignore index 1bd7945..6655ece 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,5 @@ bin/ lib/burpsuite_*.jar target/ SAMLRaiderDebug.log +.idea/ +*.iml diff --git a/BappManifest.bmf b/BappManifest.bmf index 2962b91..d9eaf6e 100644 --- a/BappManifest.bmf +++ b/BappManifest.bmf @@ -2,11 +2,11 @@ Uuid: c61cfa893bb14db4b01775554f7b802e ExtensionType: 1 Name: SAML Raider RepoName: saml-raider -ScreenVersion: 1.2.1 -SerialVersion: 4 +ScreenVersion: 1.2.2 +SerialVersion: 6 MinPlatformVersion: 0 ProOnly: False Author: Roland Bischofberger / Emanuel Duss ShortDescription: Provides a SAML message editor and a certificate management tool to help with testing SAML infrastructures. -EntryPoint: target/saml-raider-1.2.1-SNAPSHOT-jar-with-dependencies.jar +EntryPoint: target/saml-raider-1.2.2-jar-with-dependencies.jar BuildCommand: mvn package -DskipTests=true -Dmaven.javadoc.skip=true -B diff --git a/pom.xml b/pom.xml index 2fa1d63..25fec7b 100644 --- a/pom.xml +++ b/pom.xml @@ -5,7 +5,7 @@ SAML2 Burp Suite Extension ch.hsr saml-raider - 1.2.1-SNAPSHOT + 1.2.2 4.0.0 UTF-8 @@ -41,6 +41,16 @@ xml-security-impl 1.0 + + xerces + xercesImpl + 2.12.0 + + + org.apache.santuario + xmlsec + 2.1.2 + @@ -48,8 +58,8 @@ maven-compiler-plugin 3.1 - 1.7 - 1.7 + 1.8 + 1.8 jar-with-dependencies diff --git a/src/main/java/application/BurpCertificateBuilder.java b/src/main/java/application/BurpCertificateBuilder.java index 89abe73..521e540 100644 --- a/src/main/java/application/BurpCertificateBuilder.java +++ b/src/main/java/application/BurpCertificateBuilder.java @@ -49,8 +49,6 @@ import org.bouncycastle.x509.X509V3CertificateGenerator; import org.bouncycastle.x509.extension.X509ExtensionUtil; -import sun.reflect.generics.reflectiveObjects.NotImplementedException; - @SuppressWarnings("deprecation") public class BurpCertificateBuilder { X509V3CertificateGenerator certificateGenerator; @@ -183,7 +181,7 @@ private X509Certificate generateX509Certificate(PrivateKey privateKey) throws Ce // X.509v3 General if (version != 3) { - throw new NotImplementedException(); + throw new UnsupportedOperationException("Not implemented yet."); } certificateGenerator = new X509V3CertificateGenerator(); certificateGenerator.setSerialNumber(serial); diff --git a/src/main/java/helpers/XMLHelpers.java b/src/main/java/helpers/XMLHelpers.java index baacd05..c7f8d39 100644 --- a/src/main/java/helpers/XMLHelpers.java +++ b/src/main/java/helpers/XMLHelpers.java @@ -47,11 +47,11 @@ import org.xml.sax.InputSource; import org.xml.sax.SAXException; -import com.sun.org.apache.xml.internal.security.Init; -import com.sun.org.apache.xml.internal.security.signature.XMLSignature; -import com.sun.org.apache.xml.internal.security.transforms.Transforms; -import com.sun.org.apache.xml.internal.serialize.OutputFormat; -import com.sun.org.apache.xml.internal.serialize.XMLSerializer; +import org.apache.xml.security.Init; +import org.apache.xml.security.signature.XMLSignature; +import org.apache.xml.security.transforms.Transforms; +import org.apache.xml.serialize.OutputFormat; +import org.apache.xml.serialize.XMLSerializer; public class XMLHelpers { diff --git a/src/main/java/model/BurpCertificateStore.java b/src/main/java/model/BurpCertificateStore.java index d62cd16..feb1e19 100644 --- a/src/main/java/model/BurpCertificateStore.java +++ b/src/main/java/model/BurpCertificateStore.java @@ -6,6 +6,7 @@ import java.util.List; import javax.swing.tree.DefaultMutableTreeNode; +import javax.swing.tree.TreeNode; public class BurpCertificateStore { @@ -57,9 +58,9 @@ public void addCertificateChain(List burpCertificateChain) { */ public void removeCertificate(BurpCertificate burpCertificate) { @SuppressWarnings("unchecked") - Enumeration en = rootNode.depthFirstEnumeration(); + Enumeration en = rootNode.depthFirstEnumeration(); while (en.hasMoreElements()) { - DefaultMutableTreeNode foundNode = en.nextElement(); + DefaultMutableTreeNode foundNode = (DefaultMutableTreeNode) en.nextElement(); if (foundNode.getUserObject() instanceof BurpCertificate) { if (foundNode.getUserObject() == burpCertificate) { foundNode.removeFromParent(); @@ -95,9 +96,9 @@ public DefaultMutableTreeNode getRootNode() { public List getBurpCertificatesWithPrivateKey() { List certificatesWithPrivateKey = new LinkedList<>(); @SuppressWarnings("unchecked") - Enumeration en = rootNode.depthFirstEnumeration(); + Enumeration en = rootNode.depthFirstEnumeration(); while (en.hasMoreElements()) { - DefaultMutableTreeNode foundNode = en.nextElement(); + DefaultMutableTreeNode foundNode = (DefaultMutableTreeNode) en.nextElement(); if (foundNode.getUserObject() instanceof BurpCertificate) { BurpCertificate b = (BurpCertificate) foundNode.getUserObject(); if (b.hasPrivateKey()) { diff --git a/src/test/java/application/HTTPHelpersTest.java b/src/test/java/application/HTTPHelpersTest.java index 6c8f367..f0054be 100644 --- a/src/test/java/application/HTTPHelpersTest.java +++ b/src/test/java/application/HTTPHelpersTest.java @@ -1,16 +1,13 @@ package application; -import static org.junit.Assert.assertEquals; import helpers.HTTPHelpers; +import org.junit.Test; import java.io.IOException; -import java.io.UnsupportedEncodingException; +import java.util.Base64; import java.util.zip.DataFormatException; -import org.junit.Test; - -import sun.misc.BASE64Decoder; -import sun.misc.BASE64Encoder; +import static org.junit.Assert.assertEquals; public class HTTPHelpersTest { HTTPHelpers helpers = new HTTPHelpers(); @@ -19,15 +16,15 @@ public class HTTPHelpersTest { String decompressed = "http://samluelidp"; @Test - public void testInflate() throws UnsupportedEncodingException, IOException, DataFormatException { - byte[] valueDecoded = (new BASE64Decoder()).decodeBuffer(compressed); + public void testInflate() throws IOException, DataFormatException { + byte[] valueDecoded = Base64.getDecoder().decode(compressed); assertEquals(decompressed, new String(helpers.decompress(valueDecoded, true), "UTF-8")); } @Test - public void testDeflate() throws UnsupportedEncodingException, IOException, DataFormatException { + public void testDeflate() throws IOException { byte [] valueCompressed = helpers.compress(decompressed.getBytes("UTF-8"), true); - String result = (new BASE64Encoder()).encode(valueCompressed); + String result = Base64.getEncoder().encodeToString(valueCompressed); result = result.replaceAll("\\r?\\n", ""); assertEquals(compressed, result); }