Know Your Opponent – an Inference Attack Against iOS Game Center

Tampering with iOS Game Center leaderboards by proxying traffic through Burp and rewriting the submitScores score-value to the maximum signed integer, exposing weak server-side validation.

Explains how JavaScript Web Service Proxies describe WCF web service methods using JSON instead of WSDL, and how to enumerate and attack these endpoints from within Burp.

Introduces the Java Serial Killer Burp extension for Java deserialization attacks, letting testers generate ysoserial-style payloads and inject them directly into proxied HTTP requests.

A tutorial on setting up Java remote debugging for Burp extensions, walking through attaching an IDE debugger to Burp to troubleshoot custom extension code.

Some iOS apps ignore system proxy settings by using native websockets. This tutorial combines Wireshark sniffing, DNS spoofing, and a Burp MitM proxy to capture traffic on non-standard ports.

Introduces Wsdler, a Burp plugin that parses intercepted WSDL files and generates the SOAP operations as replayable requests, removing the need for Soap-UI when testing web services.