Pentesting Java Thick Applications with Burp JDSer

Introduces the Java Serial Killer Burp extension for Java deserialization attacks, letting testers generate ysoserial-style payloads and inject them directly into proxied HTTP requests.

Introduces Wsdler, a Burp plugin that parses intercepted WSDL files and generates the SOAP operations as replayable requests, removing the need for Soap-UI when testing web services.

Releases BurpAMFDSer, a Burp plugin that converts Flash AMF requests and responses to editable XML via the XStream library, with a newer build supporting Burp 1.5.01 and Intruder integration.

The final installment of the thick client series covers memory analysis: dumping a process from Task Manager, extracting strings, and why sensitive data should use mutable types that can be wiped.

Thick client series part five covers API monitoring and invocation: API Monitor logs over 500,000 calls during login, and .NET SmokeTest lets testers load assemblies and run individual methods.

Covers assembly protections like ASLR, DEP, SafeSEH, and Authenticode signing, shows how PESecurity flags unsigned binaries, and explains decompiling .NET assemblies to review code.