Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Tool release: AMF Deserialize Burp Plugin

netspi.com | blog | #deserialization | #tool-release | #plugin | #flash | #burp | #amf

Summary

Releases BurpAMFDSer, a Burp plugin that converts Flash AMF requests and responses to editable XML via the XStream library, with a newer build supporting Burp 1.5.01 and Intruder integration.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Hacking Web Services with Burp
Introduces Wsdler, a Burp plugin that parses intercepted WSDL files and generates the SOAP operations as replayable requests, removing the need for Soap-UI when testing web services.
blog · netspi.com
Pentesting Java Thick Applications with Burp JDSer
Introduces BurpJDSer, a Burp plugin that converts serialized Java traffic to editable XML using XStream, enabling testers to fuzz thick Java clients and bypass client-side controls over HTTP.
blog · netspi.com
Re-Animating ActivitySurrogateSelector
Nick Landers revives the ActivitySurrogateSelector .NET deserialization gadget, patched in .NET Framework 4.8, detailing a workaround that restores arbitrary in-memory assembly loading.
blog · netspi.com
Defeating CSRF Protections Through Expired cross-domain.xml Domains
Shows how registering an expired domain listed in a site's crossdomain.xml grants full Flash cross-domain access and defeats CSRF protections, with a Python scanner to discover such policies.
blog · netspi.com
Attacking JavaScript Web Service Proxies with Burp
Explains how JavaScript Web Service Proxies describe WCF web service methods using JSON instead of WSDL, and how to enumerate and attack these endpoints from within Burp.
blog · netspi.com
Java Deserialization Attacks with Burp
Introduces the Java Serial Killer Burp extension for Java deserialization attacks, letting testers generate ysoserial-style payloads and inject them directly into proxied HTTP requests.
back