Java Deserialization Attacks with Burp

Will Strei introduces Burp Extractor, a Burp Suite extension that extracts dynamic values like anti-CSRF tokens from responses via regex and reinserts them into requests, a generalized cookie jar.

Explains how JavaScript Web Service Proxies describe WCF web service methods using JSON instead of WSDL, and how to enumerate and attack these endpoints from within Burp.

Introduces BurpJDSer, a Burp plugin that converts serialized Java traffic to editable XML using XStream, enabling testers to fuzz thick Java clients and bypass client-side controls over HTTP.

Learn about administrative access and Remote Code Execution (RCE) exploitation from a recent Web Application Pentest.

Lars Sorenson explores NodeJS sandbox escapes, walking through reverse shell techniques and methods to regain require functionality when sandboxes block module imports, based on interpreter internals.

Cody Wass recounts discovering an XXE vulnerability in a service behind IBM's MaaS360 MDM platform, with a primer on external XML entities and how parser abuse enables file reads and SSRF.