Book Image

Burp Suite Cookbook

By : Sunny Wear
Book Image

Burp Suite Cookbook

By: Sunny Wear

Overview of this book

Burp Suite is a Java-based platform for testing the security of your web applications, and has been adopted widely by professional enterprise testers. The Burp Suite Cookbook contains recipes to tackle challenges in determining and exploring vulnerabilities in web applications. You will learn how to uncover security flaws with various test cases for complex environments. After you have configured Burp for your environment, you will use Burp tools such as Spider, Scanner, Intruder, Repeater, and Decoder, among others, to resolve specific problems faced by pentesters. You will also explore working with various modes of Burp and then perform operations on the web. Toward the end, you will cover recipes that target specific test scenarios and resolve them using best practices. By the end of the book, you will be up and running with deploying Burp for securing web applications.
Table of Contents (13 chapters)

Setting up a web app pentesting lab

The Broken Web Application (BWA) is an OWASP project that provides a self-contained VM complete with a variety of applications with known vulnerabilities. The applications within this VM enable students to learn about web application security, practice and observe web attacks, and make use of penetration tools such as Burp.

To follow the recipes shown in this book, we will utilize OWASP's BWA VM. At the time of this writing, the OWASP BWA VM can be downloaded from

Getting ready

We will download the OWASP BWA VM along with supportive tools to create our web app pentesting lab.

Software tool requirements

How to do it...

For this recipe, you will need to download the OWASP BWA VM and install it by performing the following steps:

  1. Click Download Latest Version from the OWASP BWA VM link provided earlier and unzip the file OWASP_Broken_Web_Apps_VM_1.2.7z.
  2. You will be presented with a listing of several files, as follows:
  1. All file extensions shown indicate the VM can be imported into Oracle VirtualBox or VMware Player/Workstation. For purposes of setting up the web application pentesting lab for this book, we will use Oracle VirtualBox.
  2. Make a note of the OWASP Broken Web Apps-cl1.vmdk file. Open the VirtualBox Manager (that is, the Oracle VM VirtualBox program).
  3. Within the VirtualBox Manager screen, select Machine | New from the top menu and type a name for the machine, OWASP BWA.
  4. Set the type to Linux and version to Ubuntu (64-bit), and then click Next, as follows:
  1. The next screen allows you to adjust the RAM or leave as suggested. Click Next.
  2. On the next screen, choose Use an existing virtual hard disk file.
  3. Use the folder icon on the right to select OWASP Broken Web Apps-cl1.vmdk file from the extracted list and click Create, as follows:
  1. Your VM is now loaded in the VirtualBox Manager. Let's make some minor adjustments. Highlight the OWASP BWA entry and select Settings from the top menu.
  2. Select the Network section in the left-hand pane and change to Host-only Adapter. Click OK.
  1. Now let's start the virtual machine. Right-click then choose Start | Normal Start.
  1. Wait until the Linux system is fully booted, which may take a few minutes. After the booting process is complete, you should see the following screen. However, the IP address shown will be different for your machine:
  1. The information presented on this screen identifies the URL where you can access vulnerable web applications running on the VM. For example, in the previous screenshot, the URL is You are given a prompt for administering the VM, but it is not necessary to log in at this time.
  2. Open the Firefox browser on your host system, not in the VM. Using the Firefox Browser on your host machine, enter the URL provided (for example,, where the IP address is specific to your machine.
  1. In your browser, you are presented with an index page containing links to vulnerable web applications. These applications will be used as targets throughout this book:

How it works

Leveraging a customized virtual machine created by OWASP, we can quickly set up a web app pentesting lab containing purposefully vulnerable applications, which we can use as legal targets for our exercises throughout this book.