This chapter provides the setup instructions necessary to proceed through the material in this book. Starting with downloading Burp, the details include the two main Burp editions available and their distinguishing characteristics.Â
To use the Burp suite, a penetration tester requires a target application. This chapter includes instructions on downloading and installing OWASP applications contained within a virtual machine (VM). Such applications will be used throughout the book as targeted vulnerable web applications.Â Â
Also included in this chapter is configuring a web browser to use the Burp Proxy Listener. This listener is required to capture HTTP traffic between the Burp and the target web application. Default settings for the listener include anÂ Internet Protocol (IP) address,Â
127.0.0.1, and port number
Finally, this chapter concludes with the options for starting Burp. This includes how to start Burp at the command line, also with an optional headless mode, and using the executable.
The first step inÂ learning the techniques contained within this book is to download the Burp suite. The download page is available here (https://portswigger.net/burp/). You will need to decide which edition of the Burp suite you would like to download from the following:
- Enterprise (not covered)
What is now termed Community was once labeled Free Edition. You may see both referenced on the internet, but they are one and the same.Â At the time of this writing, the Professional edition costs $399.
To help you make your decision, let's compare the two. The Community version offers many of the functions used in this book, but not all. For example, Community does not include any scanning functionality. In addition, the Community version contains some forced throttling of threads when using the Intruder functionality. There are no built-in payloads in the Community version, though you can load your own custom ones. And, finally, several Burp extensions that require Professional will, obviously, not work in the Community edition.
The Professional version has all functionality enabled including passive and active scanners. There is no forced throttled. PortSwigger (that is, the name of the company that writes and maintains the Burp suite) provides several built-in payloads for fuzzing and brute-forcing. Burp extensions using scanner-related API calls are workable in the Professional version as well.
In this book, we will be using the Professional version, which means much of the functionality is available in the Community edition. However, when a feature is used in this book specific to the Professional edition, a special icon will indicate this. The icon used is the following:
To begin our adventure together, go to https://portswigger.net/burp and download the edition of the Burp suite you wish to use. The page provides a slider, as following, which highlights the features of Professional and Community, allowing you to compare them:
Many readers may choose the Community edition to gain familiarity with the product prior to purchasing.
Should you choose to purchase or trial the Professional edition, you will need to complete forms or payments and subsequent email confirmations will be sent to you. Once your account is created, you may login and perform the download from the links provided in our account.
After deciding on the edition you need, you have two installation options, including an executable or a plain JAR file. The executable is only available in Windows and is offered in both 32-bit or 64-bit. The plain JAR file is available for Windows, macOS, and Linux.
The Windows executable is self-contained and will create icons in your program listing. However, the plain JAR file requires your platform to have Java (https://www.java.com/en/download/) pre-installed. You may choose the current version of Java (JRE or JDK) so feel free to choose the latest version:
The Broken Web Application (BWA) is an OWASP project that provides a self-contained VM complete with a variety of applications with known vulnerabilities. The applications within this VM enable students to learn about web application security, practice and observe web attacks, and make use of penetration tools such as Burp.
To follow the recipes shown in this book, we will utilize OWASP's BWA VM. At the time of this writing, the OWASP BWA VM can be downloaded from https://sourceforge.net/projects/owaspbwa/files/.
We will download the OWASP BWA VM along with supportive tools to create our web app pentesting lab.
- Oracle VirtualBox (https://www.virtualbox.org/wiki/Downloads)
- Choose an executable specific to your platform
- Mozilla Firefox BrowserÂ (https://www.mozilla.org/en-US/firefox/new/)
- 7-Zip file archiverÂ (https://www.7-zip.org/download.html)
- OWASP BWA VM (https://sourceforge.net/projects/owaspbwa/files/)
- Burp Proxy Community or Professional (https://portswigger.net/burp/)
- Oracle Java (https://www.java.com/en/download/)
For this recipe, you will need to download the OWASP BWA VM and install it by performing the following steps:
Download Latest Versionfrom the OWASP BWA VMÂ link provided earlier and unzip the fileÂ
- You will be presented with a listing of several files, as follows:
- All file extensions shown indicate the VM can be imported into Oracle VirtualBox or VMware Player/Workstation. For purposes of setting up the web application pentesting lab for this book, we will use Oracle VirtualBox.
- Make a note of theÂ
OWASP Broken Web Apps-cl1.vmdkfile. Open the VirtualBox Manager (that is, the Oracle VM VirtualBox program).Â
- Within the VirtualBox Manager screen, select
Âfrom the top menu and type a name for the machine,
- Set the type to Linux and version to Ubuntu (64-bit), and then click
- The next screen allows you to adjust the RAM or leave as suggested. Click
- On the next screen, choose
Use an existing virtual hard disk file.
- Use the folder icon on the right to selectÂ
OWASP Broken Web Apps-cl1.vmdkfile from the extracted list and click
Create, as follows:
- Now let's start the virtual machine. Right-click then choose
- Wait until the Linux system is fully booted, which may take a few minutes. After the booting process is complete, you should see the following screen. However, the IP address shown will be different for your machine:
- The information presented on this screen identifies the URL where you can access vulnerable web applications running on the VM. For example, in the previous screenshot, the URL is
http://192.168.56.101/.Â You are given a prompt for administering the VM, but it is not necessary to log in at this time.
- Open the Firefox browser on your host system, not in the VM. Using the Firefox Browser on your host machine, enter the URL provided (for example,
http://192.168.56.101/), where the IP address is specific to your machine.
- In your browser, you are presented with an index page containing links to vulnerable web applications. These applications will be used as targets throughout this book:
For non-Windows users or those Windows users who chose the plain JAR file option, you will start Burp at a command line each time they wish to run it. As such, you will require a particular Java command to do so.
In some circumstances, such as automated scripting, you may wish to invoke Burp at the command line as a line item in your shell script. Additionally, you may wish to run Burp without a graphical user interface (GUI), referred to as headless mode. This section describes how to perform these tasks.
- Start Burp in Windows, after running the installer from the downloaded
.exefile, by double-clicking the icon on desktop or select it from the programs listing:
When using the plain JAR file,Â the executable
javaÂ is followed by the option of
âjar, followed by the name of the download JAR file.
- Start Burp at the command line (minimal) with the plain JAR file (Java must be installed first):
If you prefer more control over the heap size settings (that is, the amount of memory allocated for the program) you may modify the
javaexecutable is followed by theÂ
âjar, followed by the memory allocation. In this case, 2 GB (that is,
2g) is allocated for read access memory (RAM), followed by the name of the JAR file. If you get an error to the effect that you cannot allocate that much memory, just drop the amount down to something like 1,024 MB (that is,
- Start Burp at command line (optimize) with the plain JAR file (Java must be installed first):
- It is possible to start Burp at the command line and to run it in headless mode. Headless mode meansÂ running Burp without the GUI.
For the purposes of this book, we will not be running Burp in headless mode, since we are learning through the GUI. However, you may require this information in the future, which is why it is presented here.
- Start Burp at the command line to run in headless mode with the plain JAR file (Java must be installed first):
Note the placement of the parameter
-Djava.awt.headless=true immediately following the
-jar option and before the name of the JAR file.Â
- If successful, you should see the following:
Press Ctrl + C or Ctrl + Z to stop the process.
Please consult PortSwigger's support pages for more information on this topic:Â https://support.portswigger.net/customer/portal/questions/16805563-burp-command-line.
- In each startup scenario described, you should be presented with a splash screen. The splash screen label will matchÂ whichever editionÂ you decided to download, either Professional or Community.
- You may be prompted to update the version; feel free to do this, if you like. New features are constantly added into Burp to help you find vulnerabilities, so upgrading the application is a good idea. Choose
Update Now,if applicable.
- Next, you are presented with a dialog box asking about project files and configurations:
- If you are using the Community edition, you will only be able to create a temporary project. If you are using the Professional edition, create a new project on disk, saving it in an appropriate location for you to find. Click
- The subsequent splash screen asks you about the configurations you would like to use. At this point, we don't have any yet, so choose
Use Burp defaults. As you progress through this book, you may wish to save configuration settings and load them from this splash screen in the future, as follows:
- Finally, we are ready to click
Burp is described as an intercepting proxy. This means Burp sits between the user's web browser and the application's web server and intercepts or captures all of the traffic flowing between them. This type of behavior is commonly referred to as a Proxy service.
Penetration testers use intercepting proxies to capture traffic flowing between a web browser and a web application for the purposes of analysis and manipulation. For example, a tester can pause any HTTP request, thus allowing parameter tampering prior to sending the request to the web server.
Intercepting proxies, such as Burp, allow testers to intercept both HTTP requests and HTTP responses. This allows a tester to observe the behavior of the web application under different conditions. And, as we shall see, sometimes, the behaviors are unintended from what the original developer expected.
To see the Burp suite in action, we need to configure our Firefox browser's
Network Settings to point to our running instance of Burp. This enables Burp to capture all HTTP traffic that is flowing between your browser and the target web application.Â
We will configure Firefox browser to allow Burp to listen to all HTTP traffic flowing between the browser and the OWASP BWA VM. This will allow the proxy service within Burp to capture traffic for testing purposes.Â Â
Instructions are available on PortSwigger at (https://support.portswigger.net/customer/portal/articles/1783066-configuring-firefox-to-work-with-burp) and we will also step through the process in the following recipe.
- Open the Firefox browser and go to
- In the
Generaltab, scroll down to the
Network Proxysection and then click
- In the
Connection Settings, select
Manual proxy configurationÂ and type in the IP address of
8080. Select the
Use this proxy server for all protocolsÂ checkbox:
- Make sure the
No proxyfor the textbox is blank, as shown in the following screenshot, and then click
- With the OWASP BWA VM running in the background and using Firefox to browse to the URL specific to your machine (that is, the IP address shown on the Linux VM in VirtualBox), click the reload button (the arrow in a circle) to see the traffic captured in Burp.
- If you don't happen to see any traffic, check whetherÂ Proxy Intercept is holding up the request. If the button labeledÂ
Intercept is onÂ is depressed, as shown in the following screenshot, then click the button again to disable the interception. After doing so, the traffic should flow freely into Burp, as follows:
In the following,
Intercept button is disabled:
- If everything is working properly, you will see traffic on your
Site maptab similar to what is shown in the following screenshot. Your IP address will be different, of course, and you may have more items shown within your
Site map. Congratulations! You now have Burp listening to all of your browser traffic!