Extending Burp to Find Struts and XXE Vulnerabilities

No ratings

Presented at DerbyCon VIII (Evolution) 2018 by

Chris Elgee

How do you test for Struts vulnerabilities in clients' web apps? Have you tried writing a Burp plug-in to help? Extending Burp is easier than you might think. We'll cover Burp Extension programming in Python, the power of Burp's Collaborator, and adapting Struts and XXE exploits to find vulnerabilities automatically. This will culminate in the discovery of a web app zero day.