7. Searching, Extracting, Pattern Matching, and More | Burp Suite Essentials

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Burp Suite Essentials

By : Akash Mahajan

4.2 (15)

Burp Suite Essentials

4.2 (15)

By: Akash Mahajan

Overview of this book

If you are interested in learning how to test web applications and the web part of mobile applications using Burp, then this is the book for you. It is specifically designed to meet your needs if you have basic experience in using Burp and are now aiming to become a professional Burp user.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Getting Started with Burp

1. Getting Started with Burp

Starting Burp from the command line

Specifying memory size for Burp

Ensuring that IPv4 is allowed

Working with other JVMs

Summary

2. Configuring Browsers to Proxy through Burp

2. Configuring Browsers to Proxy through Burp

Configuring widely used browsers to proxy through Burp Suite

Summary

3. Setting the Scope and Dealing with Upstream Proxies

3. Setting the Scope and Dealing with Upstream Proxies

Multiple ways to add targets to the scope

Scope and Burp Suite tools

Scope inclusion versus exclusion

Dropping out-of-scope requests

Dealing with upstream proxies and SOCKS proxies

Summary

4. SSL and Other Advanced Settings

4. SSL and Other Advanced Settings

Importing the Burp certificate in Mozilla Firefox

Importing the Burp certificate in Microsoft IE and Google Chrome

Installing the Burp certificate in iOS or Android

SSL pass-through

Invisible Proxy

Summary

5. Using Burp Tools As a Power User – Part 1

5. Using Burp Tools As a Power User – Part 1

Target

Proxy

The Message Analysis tab

Actions on the intercepted requests

Intruder

Scanner

Repeater

Summary

6. Using Burp Tools As a Power User – Part 2

6. Using Burp Tools As a Power User – Part 2

Spidering

Sequencer

Decoder

Comparer

Alerts

Summary

7. Searching, Extracting, Pattern Matching, and More

7. Searching, Extracting, Pattern Matching, and More

Filtering

Matching

Grep - Match and Grep - Extract

Summary

8. Using Engagement Tools and Other Utilities

8. Using Engagement Tools and Other Utilities

Search

Target Analyzer

Content Discovery

Task Scheduler

CSRF proof of concept Generator

Summary

9. Using Burp Extensions and Writing Your Own

9. Using Burp Extensions and Writing Your Own

Setting up the Python runtime for Burp Extensions

Setting up the Ruby environment for Burp Extensions

Loading and installing a Burp Extension from the Burp App Store

Loading and installing a Burp Extension manually

Managing Burp Extensions

Writing our own Burp Extensions

Noteworthy Burp Extensions

Summary

10. Saving Securely, Backing Up, and Other Maintenance Activities

10. Saving Securely, Backing Up, and Other Maintenance Activities

Saving and restoring a state

Automatic backups

Scheduled tasks

Logging all activities

Summary

11. Resources, References, and Links

11. Resources, References, and Links

Primary references

Web application security testing with Burp

Miscellaneous security testing tutorials with Burp Suite

Pentesting thick clients

Testing mobile applications for web security using Burp Suite

Extensions references

Books

Summary

Index

Index

Matching

Filtering makes for a powerful analysis tool. But filtering happens after the requests have been sent, the responses received, and we just need to analyze the output. What if we want to make changes on the fly? Ideally, we would like to match certain data, such as requests, responses, parameter values, header values, and more. So, while the HTTP requests and responses are going through and coming back, we can create rules to match the data and perform operations on that data.

Let's look at all the places we can perform matching and related operations:

In the Proxy | Options tab:
- Under Intercept Client Requests
- Under Intercept Server Responses
- Under Match and Replace
In Spider | Options:
- Form Submission
In Scanner | Options:
- Attack Insertion Points
In Intruder | Payloads:
- Payloads Processing

We can set rules for intercepting client requests based on conditions. Basically, a rule has a Boolean operator, a match type, a relationship based on the match type, and the condition. By default...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Burp Suite Essentials

Search

Your notes and bookmarks