ATOR (Authentication Token Obtain and Replace) Burp Plugin
summary
ATOR v3 is a Burp plugin that actually automates complex auth flows: it obtains and replaces JWTs and session tokens across multistep logins, SSO chains and OTP-protected paths, with a configurable extract/transform/replace pipeline and ATOR v3 UI improvements. Demos use Burp, show Burp plugin reducing redundant network calls, handle OTPs via mysms integration, claim 64 stars on GitHub, and the demo runs complete successfully.
AI-written summary · about
chapters (10)
- 0:00ATOR Burp Plugin intro
- 1:46Tool motivation
- 3:13API security challenges
- 8:09ATOR plugin evolution
- 13:57Basic token replacement demo
- 23:54Multi-step login demo
- 31:56SSO authentication demo
- 39:21OTP bypass automation
- 47:10JWT and CSRF handling
- 50:54Q&A
related talks
47mAuthMatrix: Simplified Authorization Testing for Web Applications
41mOSBT: OpenID Connect Scenario-Based Tester
35mHow to Break API's
33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
51mThe Future of ATO
22mAPI Authentication Deep Dive: OAuth 2.0, Tokens, and JWTs
59m{JWT}.{Misuse}.&Abuse
23mBURPing for Developers