9. Using Burp Extensions and Writing Your Own | Burp Suite Essentials

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Burp Suite Essentials

By : Akash Mahajan

4.2 (15)

Burp Suite Essentials

4.2 (15)

By: Akash Mahajan

Overview of this book

If you are interested in learning how to test web applications and the web part of mobile applications using Burp, then this is the book for you. It is specifically designed to meet your needs if you have basic experience in using Burp and are now aiming to become a professional Burp user.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Getting Started with Burp

1. Getting Started with Burp

Starting Burp from the command line

Specifying memory size for Burp

Ensuring that IPv4 is allowed

Working with other JVMs

Summary

2. Configuring Browsers to Proxy through Burp

2. Configuring Browsers to Proxy through Burp

Configuring widely used browsers to proxy through Burp Suite

Summary

3. Setting the Scope and Dealing with Upstream Proxies

3. Setting the Scope and Dealing with Upstream Proxies

Multiple ways to add targets to the scope

Scope and Burp Suite tools

Scope inclusion versus exclusion

Dropping out-of-scope requests

Dealing with upstream proxies and SOCKS proxies

Summary

4. SSL and Other Advanced Settings

4. SSL and Other Advanced Settings

Importing the Burp certificate in Mozilla Firefox

Importing the Burp certificate in Microsoft IE and Google Chrome

Installing the Burp certificate in iOS or Android

SSL pass-through

Invisible Proxy

Summary

5. Using Burp Tools As a Power User – Part 1

5. Using Burp Tools As a Power User – Part 1

Target

Proxy

The Message Analysis tab

Actions on the intercepted requests

Intruder

Scanner

Repeater

Summary

6. Using Burp Tools As a Power User – Part 2

6. Using Burp Tools As a Power User – Part 2

Spidering

Sequencer

Decoder

Comparer

Alerts

Summary

7. Searching, Extracting, Pattern Matching, and More

7. Searching, Extracting, Pattern Matching, and More

Filtering

Matching

Grep - Match and Grep - Extract

Summary

8. Using Engagement Tools and Other Utilities

8. Using Engagement Tools and Other Utilities

Search

Target Analyzer

Content Discovery

Task Scheduler

CSRF proof of concept Generator

Summary

9. Using Burp Extensions and Writing Your Own

9. Using Burp Extensions and Writing Your Own

Setting up the Python runtime for Burp Extensions

Setting up the Ruby environment for Burp Extensions

Loading and installing a Burp Extension from the Burp App Store

Loading and installing a Burp Extension manually

Managing Burp Extensions

Writing our own Burp Extensions

Noteworthy Burp Extensions

Summary

10. Saving Securely, Backing Up, and Other Maintenance Activities

10. Saving Securely, Backing Up, and Other Maintenance Activities

Saving and restoring a state

Automatic backups

Scheduled tasks

Logging all activities

Summary

11. Resources, References, and Links

11. Resources, References, and Links

Primary references

Web application security testing with Burp

Miscellaneous security testing tutorials with Burp Suite

Pentesting thick clients

Testing mobile applications for web security using Burp Suite

Extensions references

Books

Summary

Index

Index

Setting up the Ruby environment for Burp Extensions

Let's follow these steps to set up the Ruby environment:

Download a stable version of JRuby from http://www.jruby.org/download.
Download JRuby 1.7.15 Binary .zip and unzip this file. Inside the lib folder, you will find jruby.jar.
Copy this to E:\jruby\jruby.jar.
Configure the path through Extender | Options| Ruby Environment.
Note
Note that the path for JRuby depends on where you download JRuby in your machine.

We can also add the path of additional libraries required for Java-based extensions in the same place.

Before Burp Version 1.5.01+, getting extensions was not straightforward and consistent. Since the introduction of the Burp app store, it has become very convenient to load and install new extensions.

The obvious limitation is that the extension author needs to submit the extension to get it added to the Burp app store. Currently, this can be done by sending an e-mail to <[email protected]> with the subject line Submit BApp.

Once...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Burp Suite Essentials

Search

Your notes and bookmarks