blackfan/s3-request-signer

S3 Request Signer is an extension for the security testing tools Burp Suite and Caido. It is aimed at people who test the security of applications that use Amazon S3 or S3-compatible storage services such as Yandex Cloud or VK Cloud. When a security tester sends a request to one of these services with an incorrect signature, the service responds with a SignatureDoesNotMatch error. This extension reads that error response, pulls out the information needed to build a correctly signed request, and generates one automatically, saving the tester from working out the signature process by hand. The tool supports both of Amazon's signature methods, version 2 and version 4. Version 2 support relies on another Burp extension called Hackvertor, while version 4 is implemented natively within this extension and does not need Hackvertor. Users can also set up multiple S3 credential sets inside the extension, so they can quickly switch between different accounts while testing. The typical workflow has two steps. First, the tester adds an intentionally invalid signature to a request using a keyboard shortcut, which toggles between version 2 and version 4 each time it is pressed, then sends that request to trigger the SignatureDoesNotMatch error. Second, using a different keyboard shortcut for PUT requests or GET requests, the tester asks the extension to read that error and build a properly signed replacement request, which it inserts directly into the same message editor window rather than opening a new tab. Separate shortcuts exist for each of several credential sets, so a tester working across multiple S3 accounts can sign requests for any of them quickly.