Home

OCISigner Wiki

OCISigner is a Burp Suite extension that signs OCI HTTP requests using multiple authentication methods:

• API Key
• Security Token (Session)
• Config Profile (Auto)
• Instance Principal
• Resource Principal

Use this wiki to install the extension, configure profiles, and understand signing behavior.

Credential Validation Note

Note

For most credentials (with the exception of Instance Principal), Test Credentials validates by sending a signed probe request to the namespace endpoint. This is an Object Storage GetNamespace (/n/) request sent to the supplied region to confirm credential/signing behavior. Per OCI documentation here, GetNamespace does not require authorization, which makes it a good endpoint to validate credential handling regardless of granted permissions.

Figure 1. OCI Object Storage policy reference showing GetNamespace access behavior.

Start Here

• Installation and Setup
• Auth Method - API Key
• Auth Method - Security Token
• Auth Method - Config Profile
• Auth Method - Instance Principal
• Auth Method - Resource Principal
• Feature Notes
• Signature Notes and Highlights

Quick Start

1. Install OCISigner in Burp.
2. Create a profile and choose an auth type.
3. Fill profile fields and click Save.
4. Click Test Credentials.
5. Set Always Sign With to the profile.
6. Send requests through Repeater or Proxy.

Plugin View

Figure 2. OCISigner dashboard overview in Burp.

Figure 3. OCISigner context menu entry from an HTTP message.