Try this:

Code:
on *:sockread:creds.*: {
  sockread &data
  while ($sockbr) {
    sockread &data2
    bcopy &data $calc($bvar(&data,0) + 1) &data2 1 -1
  }
  if ($bfind(&data, 1, BinarySecurityToken Id="PPToken1">t=)) {
    var %start = $calc($ifmatch + 34), %end = $bfind(&data, %start,  </wsse:BinarySecurityToken>), $&
      %str = $bvar(&data, $+(%start, -, %end)).text)
  }
}


I haven't tested it but I think it should work. If it doesn't, try changing 1 -1 to 0 -1 in the /bcopy command.. I can't remember whether or not the position starts at 0!