Hacking High Scores in iOS GameCenter

Some iOS apps ignore system proxy settings by using native websockets. This tutorial combines Wireshark sniffing, DNS spoofing, and a Burp MitM proxy to capture traffic on non-standard ports.

An inference attack on iOS Game Center: automated friend requests via Burp Intruder expose SHA1 email hashes for recommended friends, letting attackers enumerate users' email addresses.

Shows intercepting iOS Passbook .pkpass files with a proxy, unzipping them, editing pass.json data, and redeploying modified coupons or gift cards to the device.

Bishop Fox shows how to bypass .NET MAUI's platform packaging to extract readable C# assemblies from Android and iOS apps, then use that shared-assembly insight to uncover critical vulnerability patterns in common business logic.

Explains how JavaScript Web Service Proxies describe WCF web service methods using JSON instead of WSDL, and how to enumerate and attack these endpoints from within Burp.

Introduces the Java Serial Killer Burp extension for Java deserialization attacks, letting testers generate ysoserial-style payloads and inject them directly into proxied HTTP requests.