Search icon
Subscription
0
Cart icon
Close icon
You have no products in your basket yet
Save more on your purchases!
Savings automatically calculated. No voucher code required
Arrow left icon
All Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Newsletters
Free Learning
Arrow right icon
$9.99 | ALL EBOOKS & VIDEOS
Over 7,000 tech titles at $9.99 each with AI-powered learning assistants on new releases
Hands-On Application Penetration Testing with Burp Suite
Hands-On Application Penetration Testing with Burp Suite

Hands-On Application Penetration Testing with Burp Suite: Use Burp Suite and its features to inspect, detect, and exploit security vulnerabilities in your web applications

By Carlos A. Lozano , Dhruv Shah , Riyaz Ahemed Walikar
$35.99 $9.99
Book Feb 2019 366 pages 1st Edition
eBook
$35.99 $9.99
Print
$48.99
Subscription
$15.99 Monthly
eBook
$35.99 $9.99
Print
$48.99
Subscription
$15.99 Monthly

What do you get with eBook?

Product feature icon Instant access to your Digital eBook purchase
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Buy Now
Table of content icon View table of contents Preview book icon Preview Book

Hands-On Application Penetration Testing with Burp Suite

Chapter 1. Configuring Burp Suite

Before starting an application penetration test, the system that will be used to attack the end application must be prepared. This involves configuring Burp Suite to become the interception proxy for various clients and traffic sources.

As with scoping for targets, it is important to reduce noise in the data we collect. We will use target whitelisting techniques, and work with the Burp Target feature to filter and reduce the clutter that testing modern applications can introduce.

Burp, or Burp Suite, is a graphical tool for testing web applications for security flaws. The tool is written in Java and was created by Dafydd Stuttard under the name of PortSwigger. Burp Suite is now actively developed by his company PortSwigger Ltd., which is based out of the United Kingdom.

Burp is available in two variants: the free version, called the Community Edition, and the Professional version. The Community Edition lacks several features and speed enhancements that the Professional variant provides.

Throughout this book, we will be using the Professional version of Burp to navigate our way through the chapters and the hands-on exercises.

We will cover the following topics in this chapter:

  • Getting to know Burp Suite
  • Setting up proxy listeners
  • Managing multiple proxy listeners
  • Working with non-proxy aware clients
  • Creating target scopes in Burp Suite
  • Working with target exclusions
  • Quick settings before beginning

 

Getting to know Burp Suite


Burp can be downloaded for all the major operating systems from the PortSwigger website at https://portswigger.net/burp. For Windows systems, both x64-bit and x32-bit installers are available. A standalone Java JAR file is also available in case you want to run Burp as a portable application.

When you start Burp Suite, you will be prompted to provide settings to set up your Burp project before you begin using the tool.

The three options available are as follows:

  • Temporary project: Select this if you want to use Burp for a quick inspection or a task that you do not need to save. You can get started immediately when you select this option and hit Next.
  • New project on disk: For a well-executed penetration test, it is very important to be able to record and retrieve logs of requests and responses that were part of the test. This option allows you to create a file on the disk that will store all the configuration data, requests, and responses, and proxy information that you set in Burp when you begin testing. A descriptive name can be provided to enable this file to be loaded in the future. A good rule of thumb is to create a name that provides information about the project itself. ClientName-TypeOfTest-DDMMYYYY is a good name to start with.
  • Open existing project: This option allows you to load any existing project files that have been created in the past using the New project on disk option. You can choose to pause the spider and scanner modules so that the project is loaded in a non-active state of attack.

Clicking on Next will take you to a page where you can choose any save configuration from before or continue using Burp defaults. You also get the option of disabling extensions when Burp starts.

Click Start Burp to continue.

Setting up proxy listeners


To use Burp as a tool for application penetration testing, it must be set as a Man in the Middle (MITM) proxy. An MITM proxy sits in between a client and a server, and allows the user to tamper or drop messages passing through. In its simplest form, Burp Suite is an MITM proxy for HTTP(S) traffic.

By default, Burp will listen on port 8080 on the localhost IP of 127.0.0.1. This can easily be changed, however, to an arbitrary free port on any IP address available on the system. To do this, follow these steps:

  1. Navigate to the Proxy | Options tab.
  2. Under Proxy Listeners, confirm that the Running checkbox is ticked in front of the proxy entry.
  3. If the checkbox refuses to check, even after you have clicked it, it very likely means that the port selected (default 8080) is being used by another process on the system. You can simply choose another port to start listening for connections:

If there is no Proxy Listener listed at all (it's rare, but this does happen), follow these steps to set up a new proxy listener:

  1. Click on Add.
  2. In the Add a new proxy listener window that opens, under the Binding tab enter a port to bind to, which would typically be 8080.
  3. Set the Bind to address to Loopback only, and click OK to create the listener.

If you plan on using Burp over the network, then you can select an interface from the drop-down list in front of the Specific address option. Be careful when using this option as this allows any user on the network to proxy traffic through your system, and allows access to the contents of the Proxy History, which may contain sensitive information, such as session cookies and login credentials. Enable this only if you trust the network you are on:

Note

If the proxy listener checkbox does not toggle to a check, it very likely means that another process on the system is listening on that port. On Windows, you can use the netstat -antob command to identify ports and the processes that are using the open port. On Linux and macOS, use the netstat -lntp command. Both need to be run in an elevated environment on their respective operating systems.

A proxy listener can be configured for various Request handling use cases. The following options are available here:

  • Redirect to host: When configured, Burp will forward every request to the specified host, regardless of the original target requested by the user agent.
  • Redirect to port: When configured, Burp will forward every request to the specified port, regardless of the original port requested by the user agent.
  • Force use of SSL: When configured, Burp will force HTTPS on all outgoing traffic, even when the request that originated from the user-agent was HTTP:

The Certificate tab allows you to configure various SSL-related options, and to fix errors that may arise during a penetration test. The following options are available on this page:

  • Use a self-signed certificate: A self-signed certificate is generated and given to the browser. This will always cause an SSL alert on modern browsers.
  • Generate CA-signed per-host certificates: This is the default option selected when a new proxy listener is created. When Burp is first run, a self-signed Certificate Authority (CA) certificate is created. This certificate can be installed as a trusted root in your browser by clicking on the Import / export CA certificate button, or from http://127.0.0.1:8080/cert (when the proxy listener is on port 8080), so that the per host certificates can be accepted without any alerts.
  • Use a custom certificate: This option allows Burp to use a custom PKCS#12 format certificate.

Note

Throughout the book, unless otherwise specified, we will be using the default option for SSL certificates.

Another very important feature that we must be aware of at this point is Burp's capability to chain multiple proxies. As with most settings in Burp, setting upstream proxy servers or SOCKS proxies can be configured in great detail.

To set an upstream proxy server, or to basically to configure Burp to forward the request to the destination web server, or to additional proxies, click on the User Options tab in the main window and scroll down to Upstream Proxy Servers. To configure an upstream proxy for all destinations, use a wildcard (*) operator.

Sometimes, customers require an IP address from which all attack traffic would originate to the end customer. In this case, simply running a Linux machine with a static IP on the internet and SSH with port forwarding enabled allows Burp to proxy its traffic through the SOCKS Proxy that this arrangement creates.

Managing multiple proxy listeners


Burp Suite can provide multiple proxy listener interfaces if there is a requirement to do so. This simply means that Burp can start listeners on different ports and different IP addresses simultaneously, each with its own configurations and settings.

For example, if a thick client application you are testing has multiple components, some of which can be configured to use a proxy, and some can't, or if its communication ports are hardcoded, or if traffic from a network-based browser or service needs to be captured, then multiple proxy listeners, each with their own configuration, can be created.

You can disable a proxy listener simply by unchecking the checkbox next to the Interface name, if required. Next, we will understand the working of the non-proxy-aware clients.

Working with non-proxy-aware clients


A non-proxy-aware client, in this context, is a client that makes HTTP requests but has no easy way to configure proxy options, or has no proxy support at all.

Common examples of non-proxy-aware clients are thick client applications or browser plugins that do not use the browser's proxy options. Burp's support for invisible proxying allows non-proxy-aware clients to connect directly to a proxy listener. This allows Burp to intercept and modify traffic based on target mappings.

Architecturally, this works by setting up a local DNS entry for the remote target that the non-proxy-aware client communicates with. This DNS entry can be made in the local hosts file, as follows:

127.0.0.1 example.org

The client then communicates with 127.0.0.1 instead of the actual IP address of example.org. To complete the circuit, local listeners would have to be set up with invisible Burp proxy support on port 80 (or whatever other port the server is listening on). The non-proxy-aware client will then resolve the domain name to 127.0.0.1, and send requests directly to the listener on that interface.

Burp, by default, will forward requests to the destination based on the host header that was obtained from the request header of the client. However, an interesting problem presents itself here. As the DNS entry for the destination has been set to 127.0.0.1, Burp will resolve the destination incorrectly and forward the request to itself, creating a loop.

This can be fixed by using an IP address instead of the domain name/hostname in the Redirect to host option under the Request handling tab, as shown in the following screenshot:

If the client communicates to multiple domains, then Burp's hostname resolution feature, available under the Project Options tab in the main window, can be used to individually map each request to the correct destination IP address. Each of these destinations should also be added to the host's file to ensure traffic destined for these hosts is sent via Burp.

Creating target scopes in Burp Suite


The target scope settings can be found under the Target | Scope tab. This allows you to configure in-scope targets for the penetration test that you are currently executing.

Adding items to target scope allows you to affect the behavior of features throughout Burp. For example, you can do the following:

  • You can set display filters to show only the items in scope. This is available under Target | Site map and under Proxy | History, and is very useful when dealing with applications that use code from a lot of third parties.
  • The Spider module is restricted to in-scope targets.
  • You can configure the proxy to intercept the requests and responses for only in-scope items.
  • In the Professional version of Burp, you can even automatically initiate vulnerability scans of in-scope items.

There are essentially two ways of adding scope items. The first, and the recommended way, is to obtain targets from proxy history. For this to happen, the following approach is taken:

  1. Set up your browser and Burp to talk to each other.
  2. Turn off interception mode in Burp and browse the application.

Start with the home page and browse to every link; log in to authenticated areas and log out; submit every form; navigate to every single path that is listed in the robots.txt, and to every single link in the application's sitemap (if available); and, if applicable, access the application as different users (either with the same or different privilege levels).

Doing this will populate the sitemap for the application as seen under the Target|Site map tab, as shown in the following screenshot:

Once targets and URLs are populated in the Site map tab, you can right-click on any item and add that item to scope. This can be done both via the Target | Site map, or via the Proxy | History tab.

The second method is to directly add items to the Target | Scope tab. Check the Use advanced scope control to enable the older interface for scope addition, which allows far more granular control over the scope entries.

Let's take an example and create our scope for an imaginary penetration test. Let's assume the application in scope is at http://mutillidae-testing.cxm/. Using the Target | Scope tab, we can add this and all future URLs from this application to the scope by setting the following:

  • Protocol: HTTP
  • Host or IP range: mutillidae-testing.cxm
  • Port: ^80$
  • File: ^*

This will add the application and any URLs on port 80 with the HTTP protocol to the scope.

You can also load a file containing a list of URLs that need to be in scope via the Load button on the Target | Scope page. This list must be URLs/targets separated by newlines. Large files may take time to load and Burp may appear frozen for a while, but will resume working when the file has been loaded and parsed.

Working with target exclusions


Just as we can add items to scope in Burp, we can also add items that need to be explicitly set out of scope. This, as is the case with in-scope items, can be added via two methods. The first is via the Proxy | History tab from the right-click context menu:

The second is from the Target scope tab in the Exclude from scope section. For example, if you want to exclude all sub-directories and files under /javascript, then the following options can be applied:

  • Protocol: HTTP
  • Host or IP range: mutillidae-testing.cxm
  • Port: ^80$
  • File: ^/javascript/.*

This will exclude all URLs under the /javascript/ directory on port 80 with the HTTP protocol.

You can also load a file containing a list of URLs that need to be excluded from scope via the Load button on the Target | Scope page. This list must be URLs/targets separated by newlines.

Both the Include in scope option and Exclude from scope option are case insensitive. /javascript/, /JavaScript/, and /jAvAscrIPt/ all mean the same for the Target | Scope feature of Burp.

Quick settings before beginning


This section highlights five quick settings that can be enabled/set/configured before beginning a test to become productive immediately:

  • Enable server response interception: By default, Burp is not configured to intercept server responses. This can, however, be enabled using the Intercept Server Responsesoptions underProxy | Options. Enable interception of responses whenRequest|Was modifiedand whenRequest|Was intercepted.
  • Enable the Unhide hidden form fields and select the Prominently highlight unhidden fields option: This can be found under the Proxy | Options | Response Modification panel. This is very useful when browsing an application that stores or uses hidden HTML form fields to make application decisions.

The hidden field is visible on the page and highlighted very conspicuously, allowing you to edit the contents directly in the page if required.

  • Enable the Don't send items to Proxy history or other Burp tools, if out of scope option: This option can be found under Proxy | Options | Miscellaneous. When enabled, this option prevents Burp from sending out-of-scope requests and responses to the Proxy | History and other Burp tools, such as Scanner and Target. These requests and responses are sent and received, but not logged in any of Burp's feature sets.
  • Set a keyboard shortcut to issue a Repeater request: This is a very useful setting that can be enabled to avoid clicking the Go button using the mouse when working with the Repeater module of Burp. Burp already allows items to be sent to Repeater via the Proxy | History tab using Ctrl + R. Switching to the Repeater window can be achieved with Ctrl + Shift + R. Adding a shortcut to sending a request using Repeater completes the chain of keystrokes required to pick an item from Proxy | History, and sending it forward.
  • Schedule a Save state operation: Burp has a task scheduler that can be invoked for certain tasks, such as resuming and pausing scans and spidering. You can reach the task scheduler from Project Options | Misc | Scheduled Tasks.
  • One of the key operations that the task scheduler supports is the auto save state. Select Save state and click Next:
    1. Select a file that will contain the save state and, if required, select the In-scope items only checkbox, as shown in the following screenshot:
    1. Select when to start the task and the interval. During a busy engagement, saving every 30 minutes is a good interval to begin with:
    1. Click finish to activate the Scheduled Task, as shown in the following screenshot:

Summary


In this chapter, we learned to prepare the Burp Suite application. We configured Burp Suite to make it the interception proxy for various clients and traffic sources. In the next chapter, we will learn how to configure the client and set up mobile devices.

Left arrow icon Right arrow icon

Key benefits

  • Master the skills to perform various types of security tests on your web applications
  • Get hands-on experience working with components like scanner, proxy, intruder and much more
  • Discover the best-way to penetrate and test web applications

Description

Burp suite is a set of graphic tools focused towards penetration testing of web applications. Burp suite is widely used for web penetration testing by many security professionals for performing different web-level security tasks. The book starts by setting up the environment to begin an application penetration test. You will be able to configure the client and apply target whitelisting. You will also learn to setup and configure Android and IOS devices to work with Burp Suite. The book will explain how various features of Burp Suite can be used to detect various vulnerabilities as part of an application penetration test. Once detection is completed and the vulnerability is confirmed, you will be able to exploit a detected vulnerability using Burp Suite. The book will also covers advanced concepts like writing extensions and macros for Burp suite. Finally, you will discover various steps that are taken to identify the target, discover weaknesses in the authentication mechanism, and finally break the authentication implementation to gain access to the administrative console of the application. By the end of this book, you will be able to effectively perform end-to-end penetration testing with Burp Suite.

What you will learn

Set up Burp Suite and its configurations for an application penetration test Proxy application traffic from browsers and mobile devices to the server Discover and identify application security issues in various scenarios Exploit discovered vulnerabilities to execute commands Exploit discovered vulnerabilities to gain access to data in various datastores Write your own Burp Suite plugin and explore the Infiltrator module Write macros to automate tasks in Burp Suite

Product Details

Country selected

Publication date : Feb 28, 2019
Length 366 pages
Edition : 1st Edition
Language : English
ISBN-13 : 9781788994064
Category :

What do you get with eBook?

Product feature icon Instant access to your Digital eBook purchase
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Buy Now

Product Details


Publication date : Feb 28, 2019
Length 366 pages
Edition : 1st Edition
Language : English
ISBN-13 : 9781788994064
Category :

Table of Contents

19 Chapters
Title Page Chevron down icon Chevron up icon
Copyright and Credits Chevron down icon Chevron up icon
Contributors Chevron down icon Chevron up icon
About Packt Chevron down icon Chevron up icon
Preface Chevron down icon Chevron up icon
1. Configuring Burp Suite Chevron down icon Chevron up icon
2. Configuring the Client and Setting Up Mobile Devices Chevron down icon Chevron up icon
3. Executing an Application Penetration Test Chevron down icon Chevron up icon
4. Exploring the Stages of an Application Penetration Test Chevron down icon Chevron up icon
5. Preparing for an Application Penetration Test Chevron down icon Chevron up icon
6. Identifying Vulnerabilities Using Burp Suite Chevron down icon Chevron up icon
7. Detecting Vulnerabilities Using Burp Suite Chevron down icon Chevron up icon
8. Exploiting Vulnerabilities Using Burp Suite - Part 1 Chevron down icon Chevron up icon
9. Exploiting Vulnerabilities Using Burp Suite - Part 2 Chevron down icon Chevron up icon
10. Writing Burp Suite Extensions Chevron down icon Chevron up icon
11. Breaking the Authentication for a Large Online Retailer Chevron down icon Chevron up icon
12. Exploiting and Exfiltrating Data from a Large Shipping Corporation Chevron down icon Chevron up icon
1. Other Books You May Enjoy Chevron down icon Chevron up icon
Index Chevron down icon Chevron up icon

Customer reviews

Top Reviews
Rating distribution
Empty star icon Empty star icon Empty star icon Empty star icon Empty star icon 0
(0 Ratings)
5 star 0%
4 star 0%
3 star 0%
2 star 0%
1 star 0%
Filter icon Filter
Top Reviews

Filter reviews by


No reviews found
Get free access to Packt library with over 7500+ books and video courses for 7 days!
Start Free Trial

FAQs

How do I buy and download an eBook? Chevron down icon Chevron up icon

Where there is an eBook version of a title available, you can buy it from the book details for that title. Add either the standalone eBook or the eBook and print book bundle to your shopping cart. Your eBook will show in your cart as a product on its own. After completing checkout and payment in the normal way, you will receive your receipt on the screen containing a link to a personalised PDF download file. This link will remain active for 30 days. You can download backup copies of the file by logging in to your account at any time.

If you already have Adobe reader installed, then clicking on the link will download and open the PDF file directly. If you don't, then save the PDF file on your machine and download the Reader to view it.

Please Note: Packt eBooks are non-returnable and non-refundable.

Packt eBook and Licensing When you buy an eBook from Packt Publishing, completing your purchase means you accept the terms of our licence agreement. Please read the full text of the agreement. In it we have tried to balance the need for the ebook to be usable for you the reader with our needs to protect the rights of us as Publishers and of our authors. In summary, the agreement says:

  • You may make copies of your eBook for your own use onto any machine
  • You may not pass copies of the eBook on to anyone else
How can I make a purchase on your website? Chevron down icon Chevron up icon

If you want to purchase a video course, eBook or Bundle (Print+eBook) please follow below steps:

  1. Register on our website using your email address and the password.
  2. Search for the title by name or ISBN using the search option.
  3. Select the title you want to purchase.
  4. Choose the format you wish to purchase the title in; if you order the Print Book, you get a free eBook copy of the same title. 
  5. Proceed with the checkout process (payment to be made using Credit Card, Debit Cart, or PayPal)
Where can I access support around an eBook? Chevron down icon Chevron up icon
  • If you experience a problem with using or installing Adobe Reader, the contact Adobe directly.
  • To view the errata for the book, see www.packtpub.com/support and view the pages for the title you have.
  • To view your account details or to download a new copy of the book go to www.packtpub.com/account
  • To contact us directly if a problem is not resolved, use www.packtpub.com/contact-us
What eBook formats do Packt support? Chevron down icon Chevron up icon

Our eBooks are currently available in a variety of formats such as PDF and ePubs. In the future, this may well change with trends and development in technology, but please note that our PDFs are not Adobe eBook Reader format, which has greater restrictions on security.

You will need to use Adobe Reader v9 or later in order to read Packt's PDF eBooks.

What are the benefits of eBooks? Chevron down icon Chevron up icon
  • You can get the information you need immediately
  • You can easily take them with you on a laptop
  • You can download them an unlimited number of times
  • You can print them out
  • They are copy-paste enabled
  • They are searchable
  • There is no password protection
  • They are lower price than print
  • They save resources and space
What is an eBook? Chevron down icon Chevron up icon

Packt eBooks are a complete electronic version of the print edition, available in PDF and ePub formats. Every piece of content down to the page numbering is the same. Because we save the costs of printing and shipping the book to you, we are able to offer eBooks at a lower cost than print editions.

When you have purchased an eBook, simply login to your account and click on the link in Your Download Area. We recommend you saving the file to your hard drive before opening it.

For optimal viewing of our eBooks, we recommend you download and install the free Adobe Reader version 9.