Home Security Burp Suite Cookbook - Second Edition

Burp Suite Cookbook - Second Edition

By Dr. Sunny Wear
ai-assist-svg-icon Book + AI Assistant
eBook + AI Assistant $39.99 $27.98
Print $49.99
Subscription $15.99 $10 p/m for three months
ai-assist-svg-icon NEW: AI Assistant (beta) Available with eBook, Print, and Subscription.
ai-assist-svg-icon NEW: AI Assistant (beta) Available with eBook, Print, and Subscription. $10 p/m for first 3 months. $15.99 p/m after that. Cancel Anytime! ai-assist-svg-icon NEW: AI Assistant (beta) Available with eBook, Print, and Subscription.
What do you get with a Packt Subscription?
Gain access to our AI Assistant (beta) for an exclusive selection of 500 books, available during your subscription period. Enjoy a personalized, interactive, and narrative experience to engage with the book content on a deeper level.
This book & 7000+ ebooks & video courses on 1000+ technologies
60+ curated reading lists for various learning paths
50+ new titles added every month on new and emerging tech
Early Access to eBooks as they are being written
Personalised content suggestions
Customised display settings for better reading experience
50+ new titles added every month on new and emerging tech
Playlists, Notes and Bookmarks to easily manage your learning
Mobile App with offline access
What do you get with a Packt Subscription?
This book & 6500+ ebooks & video courses on 1000+ technologies
60+ curated reading lists for various learning paths
50+ new titles added every month on new and emerging tech
Early Access to eBooks as they are being written
Personalised content suggestions
Customised display settings for better reading experience
50+ new titles added every month on new and emerging tech
Playlists, Notes and Bookmarks to easily manage your learning
Mobile App with offline access
What do you get with eBook + Subscription?
Download this book in EPUB and PDF formats, plus a monthly download credit
This book & 6500+ ebooks & video courses on 1000+ technologies
60+ curated reading lists for various learning paths
50+ new titles added every month on new and emerging tech
Early Access to eBooks as they are being written
Personalised content suggestions
Customised display settings for better reading experience
50+ new titles added every month on new and emerging tech
Playlists, Notes and Bookmarks to easily manage your learning
Mobile App with offline access
What do you get with a Packt Subscription?
Gain access to our AI Assistant (beta) for an exclusive selection of 500 books, available during your subscription period. Enjoy a personalized, interactive, and narrative experience to engage with the book content on a deeper level.
This book & 6500+ ebooks & video courses on 1000+ technologies
60+ curated reading lists for various learning paths
50+ new titles added every month on new and emerging tech
Early Access to eBooks as they are being written
Personalised content suggestions
Customised display settings for better reading experience
50+ new titles added every month on new and emerging tech
Playlists, Notes and Bookmarks to easily manage your learning
Mobile App with offline access
What do you get with eBook?
Along with your eBook purchase, enjoy AI Assistant (beta) access in our online reader for a personalized, interactive reading experience.
Download this book in EPUB and PDF formats
Access this title in our online reader
DRM FREE - Read whenever, wherever and however you want
Online reader with customised display settings for better reading experience
What do you get with video?
Download this video in MP4 format
Access this title in our online reader
DRM FREE - Watch whenever, wherever and however you want
Online reader with customised display settings for better learning experience
What do you get with video?
Stream this video
Access this title in our online reader
DRM FREE - Watch whenever, wherever and however you want
Online reader with customised display settings for better learning experience
What do you get with Audiobook?
Download a zip folder consisting of audio files (in MP3 Format) along with supplementary PDF
What do you get with Exam Trainer?
Flashcards, Mock exams, Exam Tips, Practice Questions
Access these resources with our interactive certification platform
Mobile compatible-Practice whenever, wherever, however you want
ai-assist-svg-icon NEW: AI Assistant (beta) Available with eBook, Print, and Subscription. ai-assist-svg-icon NEW: AI Assistant (beta) Available with eBook, Print, and Subscription. BUY NOW $10 p/m for first 3 months. $15.99 p/m after that. Cancel Anytime! ai-assist-svg-icon NEW: AI Assistant (beta) Available with eBook, Print, and Subscription.
eBook + AI Assistant $39.99 $27.98
Print $49.99
Subscription $15.99 $10 p/m for three months
What do you get with a Packt Subscription?
Gain access to our AI Assistant (beta) for an exclusive selection of 500 books, available during your subscription period. Enjoy a personalized, interactive, and narrative experience to engage with the book content on a deeper level.
This book & 7000+ ebooks & video courses on 1000+ technologies
60+ curated reading lists for various learning paths
50+ new titles added every month on new and emerging tech
Early Access to eBooks as they are being written
Personalised content suggestions
Customised display settings for better reading experience
50+ new titles added every month on new and emerging tech
Playlists, Notes and Bookmarks to easily manage your learning
Mobile App with offline access
What do you get with a Packt Subscription?
This book & 6500+ ebooks & video courses on 1000+ technologies
60+ curated reading lists for various learning paths
50+ new titles added every month on new and emerging tech
Early Access to eBooks as they are being written
Personalised content suggestions
Customised display settings for better reading experience
50+ new titles added every month on new and emerging tech
Playlists, Notes and Bookmarks to easily manage your learning
Mobile App with offline access
What do you get with eBook + Subscription?
Download this book in EPUB and PDF formats, plus a monthly download credit
This book & 6500+ ebooks & video courses on 1000+ technologies
60+ curated reading lists for various learning paths
50+ new titles added every month on new and emerging tech
Early Access to eBooks as they are being written
Personalised content suggestions
Customised display settings for better reading experience
50+ new titles added every month on new and emerging tech
Playlists, Notes and Bookmarks to easily manage your learning
Mobile App with offline access
What do you get with a Packt Subscription?
Gain access to our AI Assistant (beta) for an exclusive selection of 500 books, available during your subscription period. Enjoy a personalized, interactive, and narrative experience to engage with the book content on a deeper level.
This book & 6500+ ebooks & video courses on 1000+ technologies
60+ curated reading lists for various learning paths
50+ new titles added every month on new and emerging tech
Early Access to eBooks as they are being written
Personalised content suggestions
Customised display settings for better reading experience
50+ new titles added every month on new and emerging tech
Playlists, Notes and Bookmarks to easily manage your learning
Mobile App with offline access
What do you get with eBook?
Along with your eBook purchase, enjoy AI Assistant (beta) access in our online reader for a personalized, interactive reading experience.
Download this book in EPUB and PDF formats
Access this title in our online reader
DRM FREE - Read whenever, wherever and however you want
Online reader with customised display settings for better reading experience
What do you get with video?
Download this video in MP4 format
Access this title in our online reader
DRM FREE - Watch whenever, wherever and however you want
Online reader with customised display settings for better learning experience
What do you get with video?
Stream this video
Access this title in our online reader
DRM FREE - Watch whenever, wherever and however you want
Online reader with customised display settings for better learning experience
What do you get with Audiobook?
Download a zip folder consisting of audio files (in MP3 Format) along with supplementary PDF
What do you get with Exam Trainer?
Flashcards, Mock exams, Exam Tips, Practice Questions
Access these resources with our interactive certification platform
Mobile compatible-Practice whenever, wherever, however you want
  1. Free Chapter
    Chapter 1: Getting Started with Burp Suite
About this book
With its many features, easy-to-use interface, and flexibility, Burp Suite is the top choice for professionals looking to strengthen web application and API security. This book offers solutions to challenges related to identifying, testing, and exploiting vulnerabilities in web applications and APIs. It provides guidance on identifying security weaknesses in diverse environments by using different test cases. Once you’ve learned how to configure Burp Suite, the book will demonstrate the effective utilization of its tools, such as Live tasks, Scanner, Intruder, Repeater, and Decoder, enabling you to evaluate the security vulnerability of target applications. Additionally, you’ll explore various Burp extensions and the latest features of Burp Suite, including DOM Invader. By the end of this book, you’ll have acquired the skills needed to confidently use Burp Suite to conduct comprehensive security assessments of web applications and APIs.
Publication date:
October 2023
Publisher
Packt
Pages
450
ISBN
9781835081075

 

Getting Started with Burp Suite

This chapter provides the setup instructions necessary to proceed through the material in this book. Starting with downloading Burp, the details include the two main Burp editions available and their distinguishing characteristics.

To use Burp Suite, a penetration tester requires a target application. This chapter includes instructions on downloading and installing OWASP applications contained within a Virtual Machine (VM). Such applications will be used throughout this book as targeted vulnerable web applications.

This chapter includes instructions to configure the Burp Suite Proxy listener. This listener is required to capture all HTTP traffic flowing between your local browser and the target website. Default settings for the listener include an Internet Protocol (IP) address, 127.0.0.1, and a port number, 8080.

Finally, this chapter will conclude with the options for starting Burp Suite. This includes how to start Burp Suite at the command line, with an optional headless mode, and using the executable.

In this chapter, we will cover the following recipes:

  • Downloading Burp Suite (Community and Professional editions)
  • Setting up a web app pentesting lab
  • Creating a PortSwigger account to access Web Security Academy
  • Starting Burp Suite at a command line or as an executable
  • Listening for HTTP traffic using Burp
 

Downloading Burp Suite (Community and Professional editions)

The first step in learning the techniques contained within this book is to download the Burp Suite application. The download page is available here: https://portswigger.net/burp/. You will need to decide which edition of Burp Suite you would like to download from the following:

  • Professional
  • Community
  • Enterprise (not covered): This product is designed for large companies to run Burp Scanner across thousands of targets
  • Dastardly (not covered): This edition only provides Burp Scanner capabilities and is specifically designed to integrate with Jenkins and other CI tools as jobs within a DevOps pipeline

What is now termed Community was once labeled Free Edition. You may see both referenced on the internet, but they are the same. At the time of writing, the Professional edition costs $449.

To help you make your decision, let’s compare the two. The Community version offers many of the functions used in this book, but not all. For example, the Community version does not include any scanning functionality. In addition, the Community version contains some forced throttling of threads when using the Burp Suite Intruder functionality. There are no built-in payloads in the Community version, though you can load custom ones. And, finally, several Burp Suite extensions that require the Professional edition will, obviously, not work in the Community edition.

The Professional version has all the functionality enabled, including passive and active scanners. There is no forced throttling. PortSwigger (that is, the name of the company that writes and maintains Burp Suite) provides several built-in payloads for fuzzing and brute-forcing. Burp Suite extensions that use scanner-related API calls work in the Professional version as well.

In this book, we will be using the Professional version, which provides access to an extensive array of functionality compared to the Community edition. However, when a feature is used in this book that’s specific to the Professional edition, a special icon will indicate this:

Figure 1.1 – Burp Suite Professional icon

Figure 1.1 – Burp Suite Professional icon

Getting ready

To begin our adventure together, go to https://portswigger.net/burp and download the edition of Burp Suite you wish to use. The page provides a slider, as shown here, which highlights the features of Professional and Community, allowing you to compare them:

Figure 1.2 – Burp Suite Professional versus Community features

Figure 1.2 – Burp Suite Professional versus Community features

You may wish to choose the Community edition to gain familiarity with the product before purchasing the Professional version.

Should you choose to purchase or use the trial version of the Professional edition, you will need to complete forms or payments and subsequent email confirmations will be sent to you. Once your account is created, you may log in and perform the download from the links provided in our account.

Software tool requirements

To complete this recipe, you will need the following:

How to do it...

After deciding on the edition you need, you have two installation options, including an executable or a plain JAR file. The executable is only available in Windows and is offered in both 32-bit and 64-bit versions. The plain JAR file is available for Windows, macOS, and Linux. You can find all the available download options here: https://portswigger.net/burp/releases/professional-community-2023-4-5?requestededition=community&requestedplatform=.

The Windows executable is self-contained and will create icons in your program listing. However, the plain JAR file requires your platform to have Java (https://www.oracle.com/java/technologies/downloads/) pre-installed. You may choose the current version of Java (JRE or JDK), so feel free to choose the latest version:

Figure 1.3 – PortSwigger’s Downloads page

Figure 1.3 – PortSwigger’s Downloads page

 

Setting up a web app pentesting lab

The Broken Web Application (BWA) is an OWASP project that provides a self-contained VM complete with a variety of applications with known vulnerabilities. The applications within this VM enable students to learn about web application security, practice and observe web attacks, and make use of penetration tools such as Burp Suite.

To follow the recipes shown in this book, we will utilize OWASP’s BWA VM. At the time of writing this book, the OWASP BWA VM can be downloaded from https://sourceforge.net/projects/owaspbwa/files/.

Getting ready

We will download the OWASP BWA VM along with supportive tools to create our web app pentesting lab.

Software tool requirements

To complete this recipe, you will need the following:

How to do it...

For this recipe, you will need to download the OWASP BWA VM and install it by performing the following steps:

  1. Click Download Latest Version after clicking the OWASP BWA VM link provided earlier and unzip the OWASP_Broken_Web_Apps_VM_1.2.7z file.
  2. You will be presented with a listing of several files, as follows:
Figure 1.4 – File listing after unzipping OWASP_Broken_Web_Apps_VM_1.2.7z

Figure 1.4 – File listing after unzipping OWASP_Broken_Web_Apps_VM_1.2.7z

  1. All file extensions shown indicate that the VM can be imported into Oracle VirtualBox or VMware Player/Workstation. To set up the web application pentesting lab for this book, we will use Oracle VirtualBox.
  2. Make a note of the OWASP Broken Web Apps-cl1.vmdk file. Open VirtualBox Manager (that is, the Oracle VM VirtualBox program).
  3. Within the VirtualBox Manager screen, select Machine | New from the top menu and type a name for the machine – for example, OWASP BWA.
  4. Set Type to Linux and Version to Ubuntu (64-bit), and then click Next, as follows:
Figure 1.5 – Create Virtual Machine

Figure 1.5 – Create Virtual Machine

  1. The next screen allows you to adjust the RAM or leave it as-is. Click Next.
  2. On the next screen, choose Use an existing virtual hard disk file.
  3. Use the folder icon on the right to select the OWASP Broken Web Apps-cl1.vmdk file from the extracted list and click Create, as follows:
Figure 1.6 – Hard disk allocation

Figure 1.6 – Hard disk allocation

  1. Your VM will have been loaded into VirtualBox Manager. Let’s make some minor adjustments. Highlight the OWASP BWA entry and select Settings from the top menu.
  2. Select the Network section in the left-hand pane and change Attached to: to Host-only Adapter. Click OK:
Figure 1.7 – Network adapter settings

Figure 1.7 – Network adapter settings

  1. Now, let’s start the VM. Right-click and then choose Start | Normal Start:
Figure 1.8 – Starting the VM

Figure 1.8 – Starting the VM

  1. Wait until the Linux system is fully booted, which may take a few minutes. After the booting process is complete, you should see the following screen. Note that the IP address shown will be different for your machine:
Figure 1.9 – Your assigned IP address for the VM

Figure 1.9 – Your assigned IP address for the VM

  1. The information presented on this screen identifies the URL where you can access vulnerable web applications running on the VM. For example, in the previous screenshot, the URL is http://192.168.56.101/. You will be given a prompt to administer the VM, but it is not necessary to log in at this time.
  2. Open the Firefox browser on your host system, not in the VM. Using the Firefox browser on your host machine, enter the URL provided (for example, http://192.168.56.101/), where the IP address is specific to your machine.
  3. In your browser, you will be presented with an index page containing links to vulnerable web applications. These applications will be used as targets throughout this book:
Figure 1.10 – Splash page of the VM

Figure 1.10 – Splash page of the VM

How it works…

Leveraging a customized VM created by OWASP, we can quickly set up a web app pentesting lab containing purposefully vulnerable applications that we can use as legal targets for our exercises throughout this book.

 

Creating a PortSwigger account to access Web Security Academy

In this edition, we’ve added more web security-related labs to enrich your experience with Burp Suite. To follow along and complete these labs, you must register an account with PortSwigger.

PortSwigger provides free, online web security training through Web Security Academy (https://portswigger.net/web-security). Academy consists of learning materials, hands-on labs, and practice exams. We will use some of these labs to demonstrate hacking techniques within this book.

Getting ready

Browse to the PortSwigger site (https://portswigger.net/) and look for the LOGIN button. Click the LOGIN button to navigate to the login page, which has a registration button:

Figure 1.11 – PortSwigger LOGIN button

Figure 1.11 – PortSwigger LOGIN button

How to do it…

Follow these steps:

  1. Go to https://portswigger.net/users and select the Create account button at the bottom, next to the Log In button:
Figure 1.12 – The Create account button

Figure 1.12 – The Create account button

  1. You must provide a valid email address to receive your password for logging into the site:
Figure 1.13 – PortSwigger account creation page

Figure 1.13 – PortSwigger account creation page

You should receive the password for the account within a short amount of time.

 

Starting Burp Suite at a command line or as an executable

For non-Windows users or those Windows users who chose the plain JAR file option, you will start Burp at a command line each time you wish to run it. As such, you will require a particular Java command to do so.

In some circumstances, such as automated scripting, you may wish to invoke Burp at the command line as a line item in your shell script. Additionally, you may wish to run Burp without a Graphical User Interface (GUI), referred to as headless mode. This recipe describes how to perform these tasks.

How to do it...

We will review the commands and actions required to start the Burp Suite product:

  • After running the installer from the downloaded .exe file, start Burp in Windows by double-clicking the icon on your desktop or selecting it from the programs listing:
Figure 1.14 – Burp Suite menu items after installation

Figure 1.14 – Burp Suite menu items after installation

  • When using the plain JAR file, the java executable is followed by the option of -jar, followed by the name of the download JAR file.

Start Burp at the command line (minimal) with the plain JAR file (Java must be installed first):

C:\Burp Jar Files>java -jar burpsuite_pro_v2023.4.3.jar

If you wish to have more control over the heap size settings (that is, the amount of memory allocated for the program), you may modify the java command.

The java executable is followed by -jar, followed by the memory allocation. In this case, 2 GB (that is, 2g) is allocated for read access memory (RAM), followed by the name of the JAR file. If you receive an error to the effect that you cannot allocate that much memory, just drop the amount down to something like 1,024 MB (that is, 1024m) instead.

Start Burp at the command line (optimize) with the plain JAR file (Java must be installed first):

C:\Burp Jar Files>java -jar -Xmx2g burpsuite_pro_v2023.4.3.jar
  • It is possible to start Burp Suite from the command line and run it in headless mode. Headless mode means running Burp without the GUI.

Note

For this book, we will not be running Burp in headless mode since we are learning through the GUI. However, you may require this information in the future, which is why it is presented here.

Start Burp Suite from the command line so that it can be run in headless mode with the plain JAR file (Java must be installed first):

C:\Burp Jar Files>java -jar -Djava.awt.headless=true burpsuite_
pro_v2023.4.3.jar

Note the placement of the -Djava.awt.headless=true parameter immediately following the -jar option and before the name of the JAR file.

If successful, you should see the following:

proxy: Proxy service started on 127.0.0.1:8080

Press Ctrl + C or Ctrl + Z to stop the process.

It is possible to provide a configuration file to the headless mode command so that you can customize the port number and IP address where the proxy listener is located.

Note

Please consult PortSwigger’s support pages for more information on this topic: https://support.portswigger.net/customer/portal/questions/16805563-burp-command-line.

In each startup scenario described, you should be presented with a splash screen:

  1. The splash screen label will match whichever edition you decided to download, either Professional or Community:
Figure 1.15 – Burp Suite splash screen

Figure 1.15 – Burp Suite splash screen

  1. You may be prompted to update the version; feel free to do this, if you like. New features are constantly added to Burp to help you find vulnerabilities, so upgrading the application is a good idea. Choose Update Now, if applicable.
  2. Next, you will be presented with a dialog box asking about project files and configurations:
Figure 1.16 – Project options upon startup

Figure 1.16 – Project options upon startup

  1. If you are using the Community edition, you will only be able to create a temporary project. If you are using the Professional edition, create a new project on disk, saving it in an appropriate location so that you can find it. Click Next.
  2. The subsequent splash screen will ask you about the configurations you would like to use. At this point, we don’t have any yet, so choose Use Burp defaults. As you progress through this book, you may wish to save configuration settings and load them from this splash screen in the future, as follows:
Figure 1.17 – Configuration options upon startup

Figure 1.17 – Configuration options upon startup

  1. Finally, we are ready to click Start Burp.

How it works...

Using either the plain JAR file or the Windows executable, you can launch Burp to start the proxy listener to capture HTTP traffic. Burp offers temporary or permanent project files so that you can save activities performed in the suite.

 

Listening for HTTP traffic using Burp

Burp is described as an intercepting proxy. This means Burp sits between the user’s web browser and the application’s web server and intercepts or captures all the traffic flowing between them. This type of behavior is commonly referred to as a proxy service.

Penetration testers use intercepting proxies to capture traffic flowing between a web browser and a web application for analysis and manipulation. For example, a tester can pause any HTTP request, thus allowing parameter tampering before the request is sent to the web server.

Intercepting proxies, such as Burp, allow testers to intercept both HTTP requests and HTTP responses. This allows a tester to observe the behavior of the web application under different conditions. And, as we shall see, sometimes the behaviors are unintended, deviating from what the original developer expected.

To see Burp Suite in action, you need to configure your Firefox browser’s Network Settings so that they point to your running instance of Burp. This enables Burp to capture all HTTP traffic that is flowing between your browser and the target web application.

Getting ready

We will configure the Firefox browser to allow Burp to listen to all HTTP traffic flowing between the browser and the OWASP BWA VM. This will allow the proxy service within Burp to capture traffic for testing purposes.

Instructions for this are available on PortSwigger at https://support.portswigger.net/customer/portal/articles/1783066-configuring-firefox-to-work-with-burp. We will step through this process in this recipe.

How to do it...

Follow these steps to start listening to all HTTP traffic using Burp:

  1. Open the Firefox browser and go to Options.
  2. In the General tab, scroll down to the Network Proxy section and then click Settings.
  3. In the Connection Settings window, select Manual proxy configuration and type in an IP address of 127.0.0.1 with the port set to 8080. Select the Use this proxy server for all protocols checkbox.

Make sure the No proxy for text box is blank, as shown in the following screenshot, and then click OK:

Figure 1.18 – Manually configuring the Firefox browser to send HTTP traffic to Burp

Figure 1.18 – Manually configuring the Firefox browser to send HTTP traffic to Burp

  1. With the OWASP BWA VM running in the background and using Firefox to browse to the URL specific to your machine (that is, the IP address shown on the Linux VM in VirtualBox), click the reload button (the arrow in a circle) to see the traffic captured in Burp.
  2. If you don’t happen to see any traffic, check whether Proxy | Intercept is holding up the request. If the button labeled Intercept is on is depressed, as shown in the following screenshot, then click the button again to disable the interception. After doing so, the traffic should flow freely into Burp, as follows:
Figure 1.19 – By default, Intercept is on

Figure 1.19 – By default, Intercept is on

In the following screenshot, the Proxy | Intercept button is disabled:

Figure 1.20 – Turning Intercept off to see traffic

Figure 1.20 – Turning Intercept off to see traffic

  1. If everything is working properly, you will see traffic in your Target | Site map tab, similar to what is shown in the following screenshot. Your IP address will be different, of course, and you may have more items shown within your Site map area. Congratulations! You now have Burp listening to all of your browser traffic!
Figure 1.21 – Confirmation of HTTP traffic flowing into Burp

Figure 1.21 – Confirmation of HTTP traffic flowing into Burp

How it works...

The Burp Proxy service is listening on 127.0.0.1 at port 8080. Either of these settings can be changed so that you can listen on an alternative IP address or port number. However, for learning purposes, we will use the default settings.

There’s more…

As a simpler alternative, you can use the browser built into Burp. To access this, go to Proxy from the top menu, choose the Intercept sub-menu, and then click the Open browser button:

Figure 1.22 – Using Burp’s built-in browser instead of using an external browser (for example, Firefox)

Figure 1.22 – Using Burp’s built-in browser instead of using an external browser (for example, Firefox)

About the Author
  • Dr. Sunny Wear

    Dr. Sunny Wear is a web security architect and penetration tester. She provides secure coding classes, creates software, and performs penetration testing on web/API and mobile applications. Sunny has more than 25 years of hands-on software programming, architecture, and security experience and holds a Doctor of Science in Cybersecurity. She is a content creator on Pluralsight, with three courses on Burp Suite. She is a published author, a developer of mobile apps such as Burp Tool Buddy, and a content creator on courses related to web security and penetration testing. She regularly speaks and holds classes at security conferences such as Defcon, Hackfest, and BSides.

    Browse publications by this author
Latest Reviews (1 reviews total)
Burp Suite Cookbook - Second Edition
Unlock this book and the full library FREE for 7 days
Start now