diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9828630..a21138e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
# Changelog
+## [1.0.5] - 2024-05-22
+
+### Changed
+
+- Passive scan is disabled by default now
+
## [1.0.4] - 2024-05-02
### Changed
diff --git a/README.md b/README.md
index f6ccedc..11b684b 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,7 @@ found [here](https://github.com/blackberry/jwt-editor) and [here](https://github
* Ensure that Java JDK 17 or newer is installed
* From root of project, run the command `./gradlew jar`
-* This should place the JAR file `sign-saboteur-1.0.4.jar` within the `build/libs` directory
+* This should place the JAR file `sign-saboteur-1.0.5.jar` within the `build/libs` directory
* This can be loaded into Burp by navigating to the `Extensions` tab, `Installed` sub-tab, clicking `Add` and loading
the JAR file
* This BApp is using the newer Montoya API, so it's best to use the latest version of Burp (try the earlier adopter
diff --git a/build.gradle b/build.gradle
index fb3d2f8..4a32f5e 100644
--- a/build.gradle
+++ b/build.gradle
@@ -3,7 +3,7 @@ plugins {
}
group = 'one.d4d'
-version = '1.0.4'
+version = '1.0.5'
description = 'sign-saboteur'
repositories {
diff --git a/src/main/java/burp/SignSaboteurExtension.java b/src/main/java/burp/SignSaboteurExtension.java
index 4170df6..d630deb 100644
--- a/src/main/java/burp/SignSaboteurExtension.java
+++ b/src/main/java/burp/SignSaboteurExtension.java
@@ -96,7 +96,7 @@ public void initialize(MontoyaApi api) {
proxyWebSocketCreation.proxyWebSocket().registerProxyMessageHandler(proxyWsMessageHandler)
);
- if (isProVersion) {
+ if (isProVersion && proxyConfig.enablePassiveScan()) {
ScannerHandler scannerHandler = new ScannerHandler(presenters, signerConfig);
scanner.registerScanCheck(scannerHandler);
}
diff --git a/src/main/java/burp/config/ProxyConfig.java b/src/main/java/burp/config/ProxyConfig.java
index 4662ba3..2eb869f 100644
--- a/src/main/java/burp/config/ProxyConfig.java
+++ b/src/main/java/burp/config/ProxyConfig.java
@@ -14,13 +14,24 @@ public class ProxyConfig {
@Expose
private boolean highlightToken;
@Expose
+ private boolean enablePassiveScan;
+ @Expose
private HighlightColor highlightColor;
public ProxyConfig() {
this.highlightToken = true;
+ this.enablePassiveScan = false;
this.highlightColor = DEFAULT_HIGHLIGHT_COLOR;
}
+ public boolean enablePassiveScan() {
+ return enablePassiveScan;
+ }
+
+ public void disablePassiveScan(boolean enablePassiveScan) {
+ this.enablePassiveScan = enablePassiveScan;
+ }
+
public boolean highlightToken() {
return highlightToken;
}
diff --git a/src/main/java/one/d4d/signsaboteur/forms/SettingsView.form b/src/main/java/one/d4d/signsaboteur/forms/SettingsView.form
index b0018c9..18bf260 100644
--- a/src/main/java/one/d4d/signsaboteur/forms/SettingsView.form
+++ b/src/main/java/one/d4d/signsaboteur/forms/SettingsView.form
@@ -3,12 +3,12 @@
-
+
-
+
@@ -18,16 +18,16 @@
-
+
-
+
-
+
@@ -63,17 +63,33 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
+
-
+
diff --git a/src/main/java/one/d4d/signsaboteur/forms/SettingsView.java b/src/main/java/one/d4d/signsaboteur/forms/SettingsView.java
index 42a6c8e..1149d50 100644
--- a/src/main/java/one/d4d/signsaboteur/forms/SettingsView.java
+++ b/src/main/java/one/d4d/signsaboteur/forms/SettingsView.java
@@ -31,6 +31,7 @@ public class SettingsView {
private JCheckBox checkBoxEnableRubySignedString;
private JCheckBox checkBoxEnableJWT;
private JCheckBox checkBoxNIMBUSDS;
+ private JCheckBox checkBoxPassiveScan;
public SettingsView(Window parent, BurpConfig burpConfig, UserInterface userInterface) {
this.parent = parent;
@@ -42,6 +43,10 @@ public SettingsView(Window parent, BurpConfig burpConfig, UserInterface userInte
comboBoxHighlightColor.setEnabled(checkBoxHighlightToken.isSelected());
proxyConfig.setHighlightToken(checkBoxHighlightToken.isSelected());
});
+ checkBoxPassiveScan.setSelected(proxyConfig.enablePassiveScan());
+ checkBoxPassiveScan.addActionListener(e -> {
+ proxyConfig.disablePassiveScan(checkBoxPassiveScan.isSelected());
+ });
comboBoxHighlightColor.setModel(new DefaultComboBoxModel<>(HighlightColor.values()));
comboBoxHighlightColor.setSelectedItem(proxyConfig.highlightColor());
diff --git a/src/main/java/one/d4d/signsaboteur/itsdangerous/model/SignedTokenObjectFinder.java b/src/main/java/one/d4d/signsaboteur/itsdangerous/model/SignedTokenObjectFinder.java
index ce1077d..5b6ae90 100644
--- a/src/main/java/one/d4d/signsaboteur/itsdangerous/model/SignedTokenObjectFinder.java
+++ b/src/main/java/one/d4d/signsaboteur/itsdangerous/model/SignedTokenObjectFinder.java
@@ -507,8 +507,8 @@ public static Optional parseUnknownSignedString(String text) {
if (separator == 0) return Optional.empty();
int index = text.lastIndexOf(separator);
String message = text.substring(0, index);
- boolean isUrlencoded = message.indexOf('%') > -1;
if (message.isEmpty()) return Optional.empty();
+ boolean isUrlencoded = message.indexOf('%') > -1;
String signature = text.substring(index + 1);
try {
byte[] sign = Utils.normalization(signature.getBytes());
diff --git a/src/main/resources/salts b/src/main/resources/salts
index 6ba0643..d93213c 100644
--- a/src/main/resources/salts
+++ b/src/main/resources/salts
@@ -13,4 +13,5 @@
"signed cookie"
"encrypted cookie"
"signed encrypted cookie"
-"ActiveStorage"
\ No newline at end of file
+"ActiveStorage"
+"authenticated encrypted cookie"
\ No newline at end of file
diff --git a/src/main/resources/secrets b/src/main/resources/secrets
index 17c5cfe..8423793 100644
--- a/src/main/resources/secrets
+++ b/src/main/resources/secrets
@@ -7,6 +7,9 @@
""
"GENERATE_NEW_SECURE_RANDOM_KEY"
"your signing key here"
+"your_secret_key_here"
+"secret-key-goes-here"
+"s3Cur3"
"old keys here (for key rotation)"
"__TODO:_GENERATE_YOUR_OWN_RANDOM_VALUE_HERE__"
"61oETzKXQAGaYdkL5gEmGeJJFuYh7EQnp2X6TP1o/Vo="
diff --git a/src/main/resources/strings.properties b/src/main/resources/strings.properties
index 9b9374d..f135108 100644
--- a/src/main/resources/strings.properties
+++ b/src/main/resources/strings.properties
@@ -115,3 +115,4 @@ NIMBUSDS_label=NIMBUSDS
button_load_defaults=Load defaults
tooltip_NIMBUSDS=Use Nimbusds library to parse Json Web tokens
urlencoded_checkbox=URL Encode
+proxy_settings_enable_passwive_scan=Enable Passive scan