Book Image

Burp Suite Cookbook

By : Sunny Wear
Book Image

Burp Suite Cookbook

By: Sunny Wear

Overview of this book

Burp Suite is a Java-based platform for testing the security of your web applications, and has been adopted widely by professional enterprise testers. The Burp Suite Cookbook contains recipes to tackle challenges in determining and exploring vulnerabilities in web applications. You will learn how to uncover security flaws with various test cases for complex environments. After you have configured Burp for your environment, you will use Burp tools such as Spider, Scanner, Intruder, Repeater, and Decoder, among others, to resolve specific problems faced by pentesters. You will also explore working with various modes of Burp and then perform operations on the web. Toward the end, you will cover recipes that target specific test scenarios and resolve them using best practices. By the end of the book, you will be up and running with deploying Burp for securing web applications.
Table of Contents (13 chapters)

Listening for HTTP traffic, using Burp

Burp is described as an intercepting proxy. This means Burp sits between the user's web browser and the application's web server and intercepts or captures all of the traffic flowing between them. This type of behavior is commonly referred to as a Proxy service.

Penetration testers use intercepting proxies to capture traffic flowing between a web browser and a web application for the purposes of analysis and manipulation. For example, a tester can pause any HTTP request, thus allowing parameter tampering prior to sending the request to the web server.

Intercepting proxies, such as Burp, allow testers to intercept both HTTP requests and HTTP responses. This allows a tester to observe the behavior of the web application under different conditions. And, as we shall see, sometimes, the behaviors are unintended from what the original developer expected.

To see the Burp suite in action, we need to configure our Firefox browser's Network Settings to point to our running instance of Burp. This enables Burp to capture all HTTP traffic that is flowing between your browser and the target web application.

Getting ready

How to do it...

The following are the steps you can go through to listen to all HTTP traffic using Burp:

  1. Open the Firefox browser and go to Options.
  2. In the General tab, scroll down to the Network Proxy section and then click Settings.
  3. In the Connection Settings, select Manual proxy configuration and type in the IP address of 127.0.0.1 with port 8080. Select the Use this proxy server for all protocols checkbox:
  1. Make sure the No proxy for the textbox is blank, as shown in the following screenshot, and then click OK:
  1. With the OWASP BWA VM running in the background and using Firefox to browse to the URL specific to your machine (that is, the IP address shown on the Linux VM in VirtualBox), click the reload button (the arrow in a circle) to see the traffic captured in Burp.
  1. If you don't happen to see any traffic, check whether Proxy Intercept is holding up the request. If the button labeled Intercept is on is depressed, as shown in the following screenshot, then click the button again to disable the interception. After doing so, the traffic should flow freely into Burp, as follows:

In the following, Proxy | Intercept button is disabled:

  1. If everything is working properly, you will see traffic on your Target | Site map tab similar to what is shown in the following screenshot. Your IP address will be different, of course, and you may have more items shown within your Site map. Congratulations! You now have Burp listening to all of your browser traffic!

How it works...

The Burp Proxy service is listening on 127.0.0.1 port 8080. Either of these settings can be changed to listen on an alternative IP address or port number. However, for the purpose of learning, we will use the default settings.