Content Type Converter
Summary: PortSwigger's BApp Store lists a Burp Suite extension, Content Type Converter, that converts data submitted within requests between common formats such as JSON and XML. The extension's stated purpose is to surface vulnerabilities that only appear when a request's content type is changed, including XXE injection and flaws hidden behind web application firewalls that assume a specific incoming format.
Key Takeaway: The extension targets a gap defenders often leave open: a WAF or filter that assumes JSON while the application still accepts XML, which is exactly the condition under which XXE injection becomes reachable.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026