Before starting an application penetration test, the system that will be used to attack the end application must be prepared. This involves configuring Burp Suite to become the interception proxy for various clients and traffic sources.
As with scoping for targets, it is important to reduce noise in the data we collect. We will use target whitelisting techniques, and work with the Burp Target feature to filter and reduce the clutter that testing modern applications can introduce.
Burp, or Burp Suite, is a graphical tool for testing web applications for security flaws. The tool is written in Java and was created by Dafydd Stuttard under the name of PortSwigger. Burp Suite is now actively developed by his company PortSwigger Ltd., which is based out of the United Kingdom.
Burp is available in two variants: the free version, called the Community Edition, and the Professional version. The Community Edition lacks several features and speed enhancements that the Professional variant provides.
Throughout this book, we will be using the Professional version of Burp to navigate our way through the chapters and the hands-on exercises.
We will cover the following topics in this chapter:
- Getting to know Burp Suite
- Setting up proxy listeners
- Managing multiple proxy listeners
- Working with non-proxy aware clients
- Creating target scopes in Burp Suite
- Working with target exclusions
- Quick settings before beginning