5. Using Burp Tools As a Power User – Part 1 | Burp Suite Essentials

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Burp Suite Essentials

By : Akash Mahajan

4.2 (15)

Burp Suite Essentials

4.2 (15)

By: Akash Mahajan

Overview of this book

If you are interested in learning how to test web applications and the web part of mobile applications using Burp, then this is the book for you. It is specifically designed to meet your needs if you have basic experience in using Burp and are now aiming to become a professional Burp user.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Getting Started with Burp

1. Getting Started with Burp

Starting Burp from the command line

Specifying memory size for Burp

Ensuring that IPv4 is allowed

Working with other JVMs

Summary

2. Configuring Browsers to Proxy through Burp

2. Configuring Browsers to Proxy through Burp

Configuring widely used browsers to proxy through Burp Suite

Summary

3. Setting the Scope and Dealing with Upstream Proxies

3. Setting the Scope and Dealing with Upstream Proxies

Multiple ways to add targets to the scope

Scope and Burp Suite tools

Scope inclusion versus exclusion

Dropping out-of-scope requests

Dealing with upstream proxies and SOCKS proxies

Summary

4. SSL and Other Advanced Settings

4. SSL and Other Advanced Settings

Importing the Burp certificate in Mozilla Firefox

Importing the Burp certificate in Microsoft IE and Google Chrome

Installing the Burp certificate in iOS or Android

SSL pass-through

Invisible Proxy

Summary

5. Using Burp Tools As a Power User – Part 1

5. Using Burp Tools As a Power User – Part 1

Target

Proxy

The Message Analysis tab

Actions on the intercepted requests

Intruder

Scanner

Repeater

Summary

6. Using Burp Tools As a Power User – Part 2

6. Using Burp Tools As a Power User – Part 2

Spidering

Sequencer

Decoder

Comparer

Alerts

Summary

7. Searching, Extracting, Pattern Matching, and More

7. Searching, Extracting, Pattern Matching, and More

Filtering

Matching

Grep - Match and Grep - Extract

Summary

8. Using Engagement Tools and Other Utilities

8. Using Engagement Tools and Other Utilities

Search

Target Analyzer

Content Discovery

Task Scheduler

CSRF proof of concept Generator

Summary

9. Using Burp Extensions and Writing Your Own

9. Using Burp Extensions and Writing Your Own

Setting up the Python runtime for Burp Extensions

Setting up the Ruby environment for Burp Extensions

Loading and installing a Burp Extension from the Burp App Store

Loading and installing a Burp Extension manually

Managing Burp Extensions

Writing our own Burp Extensions

Noteworthy Burp Extensions

Summary

10. Saving Securely, Backing Up, and Other Maintenance Activities

10. Saving Securely, Backing Up, and Other Maintenance Activities

Saving and restoring a state

Automatic backups

Scheduled tasks

Logging all activities

Summary

11. Resources, References, and Links

11. Resources, References, and Links

Primary references

Web application security testing with Burp

Miscellaneous security testing tutorials with Burp Suite

Pentesting thick clients

Testing mobile applications for web security using Burp Suite

Extensions references

Books

Summary

Index

Index

Intruder

Burp Intruder is meant for exploitation and automating attacks. Most of the attacks against web applications are about sending them a lot of data and making sense of the responses. Therefore, Intruder is a very good and efficient request sender and response collector. The tool is incredibly flexible and infinitely customizable. That is great once you have the hang of it, but can be a bit overwhelming for someone just starting out.

The best way to get started is to find a request that has parameters that can be fuzzed. A login form is a good example where we can check for weak credentials by simulating a dictionary attack using the Intruder tool.

First, we choose an interesting-looking request that can and should be automated. A few examples of this would be:

Enumerating user information, such as names and passwords
Enumerating common directories and files that can cause information leakage
Fuzzing for XSS, SQLI, and path traversals

Basically, we give a baseline request to Intruder, mark...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Burp Suite Essentials

Search

Your notes and bookmarks