Debugging Burp Extensions

Broken access control often slips past dynamic testing. This article shows how secure code review of Spring annotations, expressions, and filters surfaces Java Spring privilege escalation paths early.

NetSPI shows how malicious Azure Container Registry tasks can generate and export tokens for attached Managed Identities, releasing a MicroBurst tool, Invoke-AzACRTokenGenerator, to automate it.

AWS Signer 2.0 for Burp Suite signs or re-signs AWS API requests with SigV4 as they pass through the proxy, adding a new UI, profile management, and multi-source profile import for pentesters.

NetblockTool is a Python tool that automates netblock discovery, scraping Google dorks, ARIN, and IPinfo to build a confidence-ranked list of IP ranges owned by a company and its subsidiaries.

AutoDirbuster wraps OWASP DirBuster in Python to run directory brute-forcing across multiple IP:port targets automatically, accepting Nmap gnmap files and saving per-target reports.

Evil SQL Client (ESC) is a .NET console for SQL Server discovery, access, and data exfiltration, runnable via a plain exe, MSBuild inline tasks, or PowerShell reflection for stealthy red team work.