Defeating CSRF Protections Through Expired cross-domain.xml Domains

Learn about administrative access and Remote Code Execution (RCE) exploitation from a recent Web Application Pentest.

A three-part video series demystifies Burp Suite macros: capturing dynamic values like CSRF tokens, chaining sessions, and automating complex multi-request scenarios, with practice labs included.

Lars Sorenson explores NodeJS sandbox escapes, walking through reverse shell techniques and methods to regain require functionality when sandboxes block module imports, based on interpreter internals.

Cody Wass recounts discovering an XXE vulnerability in a service behind IBM's MaaS360 MDM platform, with a primer on external XML entities and how parser abuse enables file reads and SSRF.

Will Strei introduces Burp Extractor, a Burp Suite extension that extracts dynamic values like anti-CSRF tokens from responses via regex and reinserts them into requests, a generalized cookie jar.

A practical guide to testing SSO solutions that use SAML, covering the IdP/SP message flow and common implementation mistakes involving signatures, assertions, and message expiration.