Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hacking Web Services with Burp

netspi.com | blog | #soap | #tool-release | #plugin | #web-services | #burp | #wsdl

Summary

Introduces Wsdler, a Burp plugin that parses intercepted WSDL files and generates the SOAP operations as replayable requests, removing the need for Soap-UI when testing web services.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Attacking JavaScript Web Service Proxies with Burp
Explains how JavaScript Web Service Proxies describe WCF web service methods using JSON instead of WSDL, and how to enumerate and attack these endpoints from within Burp.
blog · netspi.com
Tool release: AMF Deserialize Burp Plugin
Releases BurpAMFDSer, a Burp plugin that converts Flash AMF requests and responses to editable XML via the XStream library, with a newer build supporting Burp 1.5.01 and Intruder integration.
blog · netspi.com
Pentesting Java Thick Applications with Burp JDSer
Introduces BurpJDSer, a Burp plugin that converts serialized Java traffic to editable XML using XStream, enabling testers to fuzz thick Java clients and bypass client-side controls over HTTP.
blog · hackerone.com
Why REST Supplanted SOAP for Cross-Application Communication
Traces why REST displaced SOAP for web services: its simpler resource-oriented HTTP model and JSON payloads beat SOAP's XML envelopes and rigid standards for most use cases.
blog · netspi.com
Java Deserialization Attacks with Burp
Introduces the Java Serial Killer Burp extension for Java deserialization attacks, letting testers generate ysoserial-style payloads and inject them directly into proxied HTTP requests.
blog · netspi.com
Debugging Burp Extensions
A tutorial on setting up Java remote debugging for Burp extensions, walking through attaching an IDE debugger to Burp to troubleshoot custom extension code.
back