SalesforceApex Predator

Salesforce Apex Predator is a four-hour, hands-on workshop on attacking public Salesforce Sites. Those portals — customer support desks, partner networks, help centers, job boards — sit directly on top of the CRM holding an organization's most sensitive data, and a single over-shared object or one unsanitized string concatenated into a SOQL query is enough to hand a guest user the whole thing. Over six live lab sites you will intercept Aura traffic in Burp, enumerate accessible objects through the framework's own standard APIs, hunt @AuraEnabled Apex methods inside JavaScript bundles, exploit SELECT-clause and blind SOQL injection, discover unlinked pages through route enumeration, and pull records out of next-generation LWR sites over GraphQL — finishing with an independent capture-the-flag challenge. Every target runs on a dedicated scratch org built for this workshop: no real company data, no legal risk, and every payload below is copy-paste ready.