Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Introducing Burp Extractor

netspi.com | blog | #burp-suite | #tooling | #burp-extension | #session-handling | #web-pentesting | #csrf-token

Summary

Will Strei introduces Burp Extractor, a Burp Suite extension that extracts dynamic values like anti-CSRF tokens from responses via regex and reinserts them into requests, a generalized cookie jar.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Beautifying JSON in Burp
A native Java Burp extension that beautifies JSON in place, letting testers read and live-edit nested API responses without Jython, with edits synced back to the raw request tab.
blog · netspi.com
Burp Suite Extension: AWS Signer 2.0 Release
AWS Signer 2.0 for Burp Suite signs or re-signs AWS API requests with SigV4 as they pass through the proxy, adding a new UI, profile management, and multi-source profile import for pentesters.
blog · netspi.com
Java Deserialization Attacks with Burp
Introduces the Java Serial Killer Burp extension for Java deserialization attacks, letting testers generate ysoserial-style payloads and inject them directly into proxied HTTP requests.
tool · github.com
Ghost-Js-Burp-Extension: Burp Suite Extension to Detect Hardcoded Secrets & Endpoints in JavaScript
Streamlines JavaScript reconnaissance during bug bounty hunting and web penetration testing by uncovering hidden attack surfaces and exposed secrets with minimal noise.
blog · netspi.com
From Informational to Critical: Chaining & Elevating Web Vulnerabilities
Learn about administrative access and Remote Code Execution (RCE) exploitation from a recent Web Application Pentest.
blog · netspi.com
Automating Managed Identity Token Extraction in Azure Container Registries
NetSPI shows how malicious Azure Container Registry tasks can generate and export tokens for attached Managed Identities, releasing a MicroBurst tool, Invoke-AzACRTokenGenerator, to automate it.
back