This book on Burp is meant for web security testers. You might be using browser plugins or automated scanners or even other interception proxy tools. In this book, you will see how Burp Suite is a versatile tool that allows almost any kind of web security testing based on your needs. This book will build on how Burp can be used with upstream proxies, SSL certificates, and more. You will learn how to search, extract, and do pattern matching for requests and responses and use that knowledge to test complex and simple web applications. You will learn to use different tools and components together to form a powerful chain of tools for web testing. As a professional tester, we need to be able to report our work, safeguard it, and sometimes even extend the tools that we use.
You will learn how different components of Burp Suite can be used together and how to use Burp Suite like a pro. You will learn to embrace the user-driven workflow for testing web applications. You can customize and extend Burp according to your needs for maximum testing and minimum software.
This book has an easy-to-follow style, where we focus on understanding what the problem is that we are trying to solve and how Burp can make it easy for us to solve. Looking at scenarios, real-world use cases, and applying the philosophy of how Burp is designed makes for an easy read and a highly actionable list of items for you to take back to your workplace.
Chapter 1, Getting Started with Burp, starts with an introduction to Burp Suite. We will cover some of the advanced flags that can be passed to the software when we invoke it from the command line. By the end of this chapter, you will have a pretty good idea of running Burp Suite in various operating systems, while being able to tweak it for maximum performance.
Chapter 2, Configuring Browsers to Proxy through Burp, explains that interception proxies work best when used with a browser software. Even though it is quite simple to get Burp working with a browser, advanced users can use additional browser extensions to perform powerful and customized integrations. By the end of this chapter, you will have configured your browser to use Burp as an interception proxy. Additionally, using browser extensions, you will create a powerful chain of tools to perform web security testing.
Chapter 3, Setting the Scope and Dealing with Upstream Proxies, shows how more and more complex web applications are being tested, including the ones that run primarily on mobile platforms. How does one configure Burp Suite to intercept in such cases? Testing web applications available on the Internet is quite simple with Burp, but how do we test applications that are inside corporate networks, running on company intranets? By the end of this chapter, you will know how to work with SSH port forwarding, SOCKS-based proxies, and intercept HTTP traffic coming from mobile devices.
Chapter 4, SSL and Other Advanced Settings, teaches that SSL-enabled applications sometimes require additional configuration. Usually, you add the Burp Suite CA certificate to your browser and start testing, but sometimes this is not desirable or possible at all. Some additional settings make it possible for nonbrowser-based HTTP applications and thick clients to be tested. By the end of this chapter, you will be able to set up and test SSL-enabled applications without any errors. You will also be able to test thick clients or clients that are not proxy-aware.
Chapter 5, Using Burp Tools As a Power User – Part 1, shows that Burp Suite is powerful due to its amazing set of tools. We will start with Target, covering Site map and Scope, and then we will move to Proxy, which is the workhorse for testers. Then, we will move to the attack tool of choice, Intruder. After Intruder, we will cover the Scanner tool and discuss when we should use the Scanner tool. We will end the chapter with the Repeater tool, which supercharges the manual testing part by making it dead simple to repeat requests and see responses.
Chapter 6, Using Burp Tools As a Power User – Part 2, covers the other tools that make up the Burp Suite software and shows us how tools such as Spider, Sequencer, Decoder, Comparer, and Alerts work in sync to provide us with what we need to test web applications.
Chapter 7, Searching, Extracting, Pattern Matching, and More, explains that the suite of tools provided by Burp is quite powerful in terms of performing the heavy lifting of crafting HTTP requests and responses based on our actions on the web applications. An important aspect of this power is the ability to match, extract, find, grep, and search all the requests and responses based on our requirements. In this chapter, you will learn the various ways in which we can search, extract, and pattern match data in requests and responses, which allow us to complete our testing.
Chapter 8, Using Engagement Tools and Other Utilities, covers something called the engagement tools of Burp suite. These tools allow us to automate some of the more mundane and boring parts of the security testing process. Engagement tools is a Pro-only feature of Burp Suite. Apart from the engagement tools, we will look at some smaller utilities that aid the testing process such as Search, Target Analyzer, Content Discovery, Task Scheduler, CSRF PoC Generator, and Manual Testing Simulator.
Chapter 9, Using Burp Extensions and Writing Your Own, shows that not only does Burp Suite come with its own rich set of tools, but it also provides API interfaces to extend its functionality. Many security researchers have written extensions that enhance the native functionality or add to the already rich toolset. By the end of this chapter, you will be able to use Burp Extensions and even write a sample extension in Python.
Chapter 10, Saving Securely, Backing Up, and Other Maintenance Activities, states that Burp Suite is just like any other testing tool. As with any software, it is imperative that you make regular backups and carry out other maintenance activities. By the end of this chapter, you will have all the knowledge about ensuring that your Burp Suite data is backed up properly and securely and how you can run scheduled tasks for backup and other maintenance activities.
Chapter 11, Resources, References, and Links, provides a number of great resources and references that you can rely on. It provides you with the primary references that you should follow to get more insight into how web security practitioners use Burp. We will list useful and informative resources for application security as well.
As this is a book about Burp Suite, we need Burp Suite. Most of the topics can be covered using the free version, but some of the topics require the Burp Suite Pro version.
To use Burp Suite, which is an application written in Java, we need the Java Runtime Environment. While Java 7 should suffice, the software will run okay with Java 8 as well.
To follow the steps and try out web security testing, we require a modern web browser, such as Mozilla Firefox, Google Chrome, Microsoft Internet Explorer, or others.
To try out Burp Extensions or attempt to write one would require Jython or JRuby based on the language you choose.
This book is for anyone interested in learning how to use Burp Suite to test web applications.
If you have some experience of web security testing and Burp Suite as well but now would like to become proficient in using all the different tools and options present in Burp Suite so that your testing can become more powerful and effective, this is the book for you.
In this book, you will find a number of styles of text that distinguish between different kinds of information. Here are some examples of these styles, and an explanation of their meaning.
Code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: "The official documentation cautions users from double-clicking on the .jar file."
A block of code is set as follows:
# Since we didn't get a request, we will look at response. responseInfo = self._helpers.analyzeResponse(self._helpers.bytesToString(messageInfo.getResponse())) # Many times, we figure out next steps based on the status code of the response. self._stdout.println(responseInfo.getStatusCode())
Any command-line input or output is written as follows:
java -jar -Xmx2048M /path/to/burpsuite.jar java -jar -Xmx2G /path/to/burpsuite.jar
New terms and important words are shown in bold. Words that you see on the screen, in menus or dialog boxes for example, appear in the text like this: "We need the JRE, so click on the Download button under JRE."
Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or may have disliked. Reader feedback is important for us to develop titles that you really get the most out of.
To send us general feedback, simply send an e-mail to <[email protected]>, and mention the book title via the subject of your message.
If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide on www.packtpub.com/authors.
Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.
Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you find a mistake in one of our books—maybe a mistake in the text or the code—we would be grateful if you would report this to us. By doing so, you can save other readers from frustration and help us improve subsequent versions of this book. If you find any errata, please report them by visiting http://www.packtpub.com/submit-errata, selecting your book, clicking on the errata submission form link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata will be uploaded on our website, or added to any list of existing errata, under the Errata section of that title. Any existing errata can be viewed by selecting your title from http://www.packtpub.com/support.
Piracy of copyright material on the Internet is an ongoing problem across all media. At Packt, we take the protection of our copyright and licenses very seriously. If you come across any illegal copies of our works, in any form, on the Internet, please provide us with the location address or website name immediately so that we can pursue a remedy.
Please contact us at <[email protected]> with a link to the suspected pirated material.
We appreciate your help in protecting our authors, and our ability to bring you valuable content.
You can contact us at <[email protected]> if you are having a problem with any aspect of the book, and we will do our best to address it.