MageCart, and others, take advantage of CDNs as watering holes, using JavaScript to directly attack consumers while bypassing traditional application security controls. These types of attacks are challenging to detect, but it’s possible to use new browser security controls (sub resource integrity) and threat intelligence to combat these attacks. We’ll briefly talk about the history of the attacks, the controls available to assist, how to configure them, and then walk through use of a new BurpSuite extension which integrates with intelligence data and helps organizations shore up their applications.