Attacking JavaScript Web Service Proxies with Burp

Introduces Wsdler, a Burp plugin that parses intercepted WSDL files and generates the SOAP operations as replayable requests, removing the need for Soap-UI when testing web services.

Lars Sorenson explores NodeJS sandbox escapes, walking through reverse shell techniques and methods to regain require functionality when sandboxes block module imports, based on interpreter internals.

Introduces the Java Serial Killer Burp extension for Java deserialization attacks, letting testers generate ysoserial-style payloads and inject them directly into proxied HTTP requests.

Traces why REST displaced SOAP for web services: its simpler resource-oriented HTTP model and JSON payloads beat SOAP's XML envelopes and rigid standards for most use cases.

Learn about administrative access and Remote Code Execution (RCE) exploitation from a recent Web Application Pentest.

A deep dive into JavaScript prototype pollution: how attackers control undeclared variables to turn weakly-typed checks into XSS on the client side or remote code execution on the server side.