Working with Burp Suite Macros and Extensions

This chapter covers two separate topics that can also be blended together: macros and extensions. Burp Suite macros enable penetration testers to automate events, such as logins or parameter reads, to overcome potential error situations. Extensions, also known as plugins, extend the core functionality found in Burp.

In this chapter, we will cover the following recipes:

• Creating session-handling macros
• Getting caught in the cookie jar
• Adding great pentester plugins
• Creating new issues via the Add & Track Custom Issues extension
• Working with the Active Scan++ extension
• Using Burp Suite extensions for bug bounties

Technical requirements

In order to complete the recipes in this chapter, you will need the following:

• OWASP Broken Web Applications (BWA)
• OWASP Mutillidae (http://<Your_VM_Assigned_IP_Address>/mutillidae)
• GetBoo (http://<Your_VM_Assigned_IP_Address>/getboo)
• Burp Proxy Community or Professional (https://portswigger.net/burp/)

Creating session-handling macros

In Burp Suite, the Project options tab allows testers to set up session-handling rules. A session-handling rule allows a tester to specify a set of actions Burp Suite will take in relation to session tokens or cross-site request forgery (CSRF) tokens while making HTTP requests. There is a default session-handling rule in scope for Spider and Scanner. However, in this recipe, we will create a new session-handling rule and use a macro to help us create an authenticated session from an unauthenticated one while using Repeater.

Getting ready

Using the OWASP Mutillidae II application, we will create a new Burp Suite session-handling rule, with an associated macro, to create an authenticated session from an unauthenticated one while using Repeater.

How to do it...

1. Navigate to the Login page in Mutillidae. Log in to the application with the username ed with the password pentest:

Figure 10.1 – Logging in...

Getting caught in the cookie jar

While targeting an application, Burp Suite captures all cookies while proxying and crawling. Burp Suite stores these cookies in a cache called the cookie jar. This cookie jar is used within the default session-handling rule and can be shared among the suite of Burp Suite tools, such as Proxy, Intruder, and Repeater. Inside the cookie jar, there is a historical table of requests. The table details each cookie domain and path. It is possible to edit or remove cookies from the cookie jar.

Getting ready

We will open the Burp Suite cookie jar and look inside. Then, using the OWASP GetBoo application, we’ll identify new cookies added to the Burp Suite cookie jar.

How to do it...

1. Click the Burp Suite Settings gear icon in the top-right corner:

Figure 10.19 – Global Settings gear icon

Then, select the Sessions area and go to the Cookie jar section:

Figure 10.20 –...

Adding great pentester plugins

As web application testers, you will find handy tools to add to your repertoire to make your assessments more efficient. The Burp Suite community offers many wonderful extensions. In this recipe, we will add a couple of them and explain how they can make your assessments better. Get All Params (GAP) and Software Vulnerability Scanner are the two plugins we will add to Burp Suite and use with the passive scanner.

Note

Both plugins require the Burp Suite Professional version.

Getting ready

Using the OWASP Mutillidae II application, we will add two handy extensions that will help us find more vulnerabilities in our target.

How to do it...

1. The first extension, GAP-Burp-Extension, is available at the following GitHub repository: https://github.com/xnl-h4ck3r/GAP-Burp-Extension. Install Git on Linux or Git for Windows (https://gitforwindows.org/). Then, using the git clone https://github.com/xnl-h4ck3r/GAP-Burp-Extension.git command,...

Creating new issues via the Add & Track Custom Issues extension

Though Burp Suite provides a listing of many security vulnerabilities commonly found in web applications, occasionally you will identify an issue and need to create a custom scan finding. This can be done using the Add & Track Custom Issues extension.

Note

This plugin requires the Burp Suite Professional edition.

Getting ready

Using the OWASP Mutillidae II application, we will add the Add & Track Custom Issues extension, create steps revealing a finding, and then use the extension to create a custom issue.

How to do it...

1. Switch to the Burp Suite Extension tab. Go to the BApp Store subtab and find the plugin labeled Add & Track Custom Issues. Click the Install button:

Figure 10.45 – Add & Track Custom Issues extension

2. Ensure the extension is loaded and enabled in the Extensions | Installed | Burp extensions section:

...

Working with the Active Scan++ extension

Some extensions assist in finding vulnerabilities with specific payloads, such as XML, or help to find hidden issues, such as cache poisoning and DNS rebinding. In this recipe, we will add an active scanner extension called Active Scan++, which assists with identifying these more specialized vulnerabilities.

Note

This plugin requires the Burp Suite Professional edition.

Getting ready

Using the OWASP Mutillidae II application, we will add the Active Scan++ extension, and then run an active scan against the target.

How to do it...

1. Switch to Burp Suite’s Extensions | BApp Store tab and select the Active Scan++ extension. Click the Install button to install the extension, as follows:

Figure 10.52 – Active Scan++ extension

2. Return to the Firefox browser and browse to the Mutillidae home page.
3. Switch to Burp Suite’s Target tab and then the Site map subtab, right...

Using Burp Suite extensions for bug bounties

As bug bounty hunters, you will find handy tools to identify possible bugs more easily. There are many, but the two we will look at in this recipe are the Burp Bounty, Scan Check Builder and Auth Analyzer.

Note

Burp Bounty, Scan Check Builder requires the Burp Suite Professional version.

Getting ready

Both recommended extensions for bug bounty hunting can be found in the BApp Store subtab. We will download and install them within our Burp Suite instance. Then, we’ll see how to use each to potentially uncover bugs for payouts!

How to do it...

1. Inside Burp Suite’s Extensions | BApp Store tab, select Burp Bounty, Scan Check Builder and click the Install button. Then, select Auth Analyzer and click the Install button:

Figure 10.55 – The two extensions covered in this recipe

2. Switch to the Extensions | Installed tab and ensure both extensions are installed and enabled...