FINN.no's mobile app signs requests to appsgw.finn.no with a FINN-GW-KEY header. This Burp Suite extension resignes all requests with this header, so the requests can be modified as usual with Burp or a downstream proxy.

Use an extension like Logger++ to see the actual modified requests.

Build with mvn assembly:assembly -DdescriptorId=jar-with-dependencies. A current build is included in ./target/finn-request-signer-1.0-SNAPSHOT-jar-with-dependencies.jar.

Algorithm for signing the requests is the property of FINN. Reverse engineered and adapted by Intigriti user jonare. Please consider adding him as a collaborator in reports where this extension was useful.