Hands-On Application Penetration Testing with Burp Suite

3 (2 reviews total)
By Carlos A. Lozano , Dhruv Shah , Riyaz Ahemed Walikar
    Advance your knowledge in tech with a Packt subscription

  • Instant online access to over 7,500+ books and videos
  • Constantly updated with 100+ new titles each month
  • Breadth and depth in over 1,000+ technologies
  1. Configuring Burp Suite

About this book

Burp suite is a set of graphic tools focused towards penetration testing of web applications. Burp suite is widely used for web penetration testing by many security professionals for performing different web-level security tasks.

The book starts by setting up the environment to begin an application penetration test. You will be able to configure the client and apply target whitelisting. You will also learn to setup and configure Android and IOS devices to work with Burp Suite. The book will explain how various features of Burp Suite can be used to detect various vulnerabilities as part of an application penetration test. Once detection is completed and the vulnerability is confirmed, you will be able to exploit a detected vulnerability using Burp Suite. The book will also covers advanced concepts like writing extensions and macros for Burp suite. Finally, you will discover various steps that are taken to identify the target, discover weaknesses in the authentication mechanism, and finally break the authentication implementation to gain access to the administrative console of the application.

By the end of this book, you will be able to effectively perform end-to-end penetration testing with Burp Suite.

Publication date:
February 2019
Publisher
Packt
Pages
366
ISBN
9781788994064

 

Chapter 1. Configuring Burp Suite

Before starting an application penetration test, the system that will be used to attack the end application must be prepared. This involves configuring Burp Suite to become the interception proxy for various clients and traffic sources.

As with scoping for targets, it is important to reduce noise in the data we collect. We will use target whitelisting techniques, and work with the Burp Target feature to filter and reduce the clutter that testing modern applications can introduce.

Burp, or Burp Suite, is a graphical tool for testing web applications for security flaws. The tool is written in Java and was created by Dafydd Stuttard under the name of PortSwigger. Burp Suite is now actively developed by his company PortSwigger Ltd., which is based out of the United Kingdom.

Burp is available in two variants: the free version, called the Community Edition, and the Professional version. The Community Edition lacks several features and speed enhancements that the Professional variant provides.

Throughout this book, we will be using the Professional version of Burp to navigate our way through the chapters and the hands-on exercises.

We will cover the following topics in this chapter:

  • Getting to know Burp Suite
  • Setting up proxy listeners
  • Managing multiple proxy listeners
  • Working with non-proxy aware clients
  • Creating target scopes in Burp Suite
  • Working with target exclusions
  • Quick settings before beginning

 

 

Getting to know Burp Suite


Burp can be downloaded for all the major operating systems from the PortSwigger website at https://portswigger.net/burp. For Windows systems, both x64-bit and x32-bit installers are available. A standalone Java JAR file is also available in case you want to run Burp as a portable application.

When you start Burp Suite, you will be prompted to provide settings to set up your Burp project before you begin using the tool.

The three options available are as follows:

  • Temporary project: Select this if you want to use Burp for a quick inspection or a task that you do not need to save. You can get started immediately when you select this option and hit Next.
  • New project on disk: For a well-executed penetration test, it is very important to be able to record and retrieve logs of requests and responses that were part of the test. This option allows you to create a file on the disk that will store all the configuration data, requests, and responses, and proxy information that you set in Burp when you begin testing. A descriptive name can be provided to enable this file to be loaded in the future. A good rule of thumb is to create a name that provides information about the project itself. ClientName-TypeOfTest-DDMMYYYY is a good name to start with.
  • Open existing project: This option allows you to load any existing project files that have been created in the past using the New project on disk option. You can choose to pause the spider and scanner modules so that the project is loaded in a non-active state of attack.

Clicking on Next will take you to a page where you can choose any save configuration from before or continue using Burp defaults. You also get the option of disabling extensions when Burp starts.

Click Start Burp to continue.

 

Setting up proxy listeners


To use Burp as a tool for application penetration testing, it must be set as a Man in the Middle (MITM) proxy. An MITM proxy sits in between a client and a server, and allows the user to tamper or drop messages passing through. In its simplest form, Burp Suite is an MITM proxy for HTTP(S) traffic.

By default, Burp will listen on port 8080 on the localhost IP of 127.0.0.1. This can easily be changed, however, to an arbitrary free port on any IP address available on the system. To do this, follow these steps:

  1. Navigate to the Proxy | Options tab.
  2. Under Proxy Listeners, confirm that the Running checkbox is ticked in front of the proxy entry.
  3. If the checkbox refuses to check, even after you have clicked it, it very likely means that the port selected (default 8080) is being used by another process on the system. You can simply choose another port to start listening for connections:

If there is no Proxy Listener listed at all (it's rare, but this does happen), follow these steps to set up a new proxy listener:

  1. Click on Add.
  2. In the Add a new proxy listener window that opens, under the Binding tab enter a port to bind to, which would typically be 8080.
  3. Set the Bind to address to Loopback only, and click OK to create the listener.

If you plan on using Burp over the network, then you can select an interface from the drop-down list in front of the Specific address option. Be careful when using this option as this allows any user on the network to proxy traffic through your system, and allows access to the contents of the Proxy History, which may contain sensitive information, such as session cookies and login credentials. Enable this only if you trust the network you are on:

Note

If the proxy listener checkbox does not toggle to a check, it very likely means that another process on the system is listening on that port. On Windows, you can use the netstat -antob command to identify ports and the processes that are using the open port. On Linux and macOS, use the netstat -lntp command. Both need to be run in an elevated environment on their respective operating systems.

A proxy listener can be configured for various Request handling use cases. The following options are available here:

  • Redirect to host: When configured, Burp will forward every request to the specified host, regardless of the original target requested by the user agent.
  • Redirect to port: When configured, Burp will forward every request to the specified port, regardless of the original port requested by the user agent.
  • Force use of SSL: When configured, Burp will force HTTPS on all outgoing traffic, even when the request that originated from the user-agent was HTTP:

The Certificate tab allows you to configure various SSL-related options, and to fix errors that may arise during a penetration test. The following options are available on this page:

  • Use a self-signed certificate: A self-signed certificate is generated and given to the browser. This will always cause an SSL alert on modern browsers.
  • Generate CA-signed per-host certificates: This is the default option selected when a new proxy listener is created. When Burp is first run, a self-signed Certificate Authority (CA) certificate is created. This certificate can be installed as a trusted root in your browser by clicking on the Import / export CA certificate button, or from http://127.0.0.1:8080/cert (when the proxy listener is on port 8080), so that the per host certificates can be accepted without any alerts.
  • Use a custom certificate: This option allows Burp to use a custom PKCS#12 format certificate.

Note

Throughout the book, unless otherwise specified, we will be using the default option for SSL certificates.

Another very important feature that we must be aware of at this point is Burp's capability to chain multiple proxies. As with most settings in Burp, setting upstream proxy servers or SOCKS proxies can be configured in great detail.

To set an upstream proxy server, or to basically to configure Burp to forward the request to the destination web server, or to additional proxies, click on the User Options tab in the main window and scroll down to Upstream Proxy Servers. To configure an upstream proxy for all destinations, use a wildcard (*) operator.

Sometimes, customers require an IP address from which all attack traffic would originate to the end customer. In this case, simply running a Linux machine with a static IP on the internet and SSH with port forwarding enabled allows Burp to proxy its traffic through the SOCKS Proxy that this arrangement creates.

 

Managing multiple proxy listeners


Burp Suite can provide multiple proxy listener interfaces if there is a requirement to do so. This simply means that Burp can start listeners on different ports and different IP addresses simultaneously, each with its own configurations and settings.

For example, if a thick client application you are testing has multiple components, some of which can be configured to use a proxy, and some can't, or if its communication ports are hardcoded, or if traffic from a network-based browser or service needs to be captured, then multiple proxy listeners, each with their own configuration, can be created.

You can disable a proxy listener simply by unchecking the checkbox next to the Interface name, if required. Next, we will understand the working of the non-proxy-aware clients.

 

Working with non-proxy-aware clients


A non-proxy-aware client, in this context, is a client that makes HTTP requests but has no easy way to configure proxy options, or has no proxy support at all.

Common examples of non-proxy-aware clients are thick client applications or browser plugins that do not use the browser's proxy options. Burp's support for invisible proxying allows non-proxy-aware clients to connect directly to a proxy listener. This allows Burp to intercept and modify traffic based on target mappings.

Architecturally, this works by setting up a local DNS entry for the remote target that the non-proxy-aware client communicates with. This DNS entry can be made in the local hosts file, as follows:

127.0.0.1 example.org

The client then communicates with 127.0.0.1 instead of the actual IP address of example.org. To complete the circuit, local listeners would have to be set up with invisible Burp proxy support on port 80 (or whatever other port the server is listening on). The non-proxy-aware client will then resolve the domain name to 127.0.0.1, and send requests directly to the listener on that interface.

Burp, by default, will forward requests to the destination based on the host header that was obtained from the request header of the client. However, an interesting problem presents itself here. As the DNS entry for the destination has been set to 127.0.0.1, Burp will resolve the destination incorrectly and forward the request to itself, creating a loop.

This can be fixed by using an IP address instead of the domain name/hostname in the Redirect to host option under the Request handling tab, as shown in the following screenshot:

If the client communicates to multiple domains, then Burp's hostname resolution feature, available under the Project Options tab in the main window, can be used to individually map each request to the correct destination IP address. Each of these destinations should also be added to the host's file to ensure traffic destined for these hosts is sent via Burp.

 

Creating target scopes in Burp Suite


The target scope settings can be found under the Target | Scope tab. This allows you to configure in-scope targets for the penetration test that you are currently executing.

Adding items to target scope allows you to affect the behavior of features throughout Burp. For example, you can do the following:

  • You can set display filters to show only the items in scope. This is available under Target | Site map and under Proxy | History, and is very useful when dealing with applications that use code from a lot of third parties.
  • The Spider module is restricted to in-scope targets.
  • You can configure the proxy to intercept the requests and responses for only in-scope items.
  • In the Professional version of Burp, you can even automatically initiate vulnerability scans of in-scope items.

There are essentially two ways of adding scope items. The first, and the recommended way, is to obtain targets from proxy history. For this to happen, the following approach is taken:

  1. Set up your browser and Burp to talk to each other.
  2. Turn off interception mode in Burp and browse the application.

Start with the home page and browse to every link; log in to authenticated areas and log out; submit every form; navigate to every single path that is listed in the robots.txt, and to every single link in the application's sitemap (if available); and, if applicable, access the application as different users (either with the same or different privilege levels).

Doing this will populate the sitemap for the application as seen under the Target|Site map tab, as shown in the following screenshot:

Once targets and URLs are populated in the Site map tab, you can right-click on any item and add that item to scope. This can be done both via the Target | Site map, or via the Proxy | History tab.

The second method is to directly add items to the Target | Scope tab. Check the Use advanced scope control to enable the older interface for scope addition, which allows far more granular control over the scope entries.

Let's take an example and create our scope for an imaginary penetration test. Let's assume the application in scope is at http://mutillidae-testing.cxm/. Using the Target | Scope tab, we can add this and all future URLs from this application to the scope by setting the following:

  • Protocol: HTTP
  • Host or IP range: mutillidae-testing.cxm
  • Port: ^80$
  • File: ^*

This will add the application and any URLs on port 80 with the HTTP protocol to the scope.

You can also load a file containing a list of URLs that need to be in scope via the Load button on the Target | Scope page. This list must be URLs/targets separated by newlines. Large files may take time to load and Burp may appear frozen for a while, but will resume working when the file has been loaded and parsed.

 

Working with target exclusions


Just as we can add items to scope in Burp, we can also add items that need to be explicitly set out of scope. This, as is the case with in-scope items, can be added via two methods. The first is via the Proxy | History tab from the right-click context menu:

The second is from the Target scope tab in the Exclude from scope section. For example, if you want to exclude all sub-directories and files under /javascript, then the following options can be applied:

  • Protocol: HTTP
  • Host or IP range: mutillidae-testing.cxm
  • Port: ^80$
  • File: ^/javascript/.*

This will exclude all URLs under the /javascript/ directory on port 80 with the HTTP protocol.

You can also load a file containing a list of URLs that need to be excluded from scope via the Load button on the Target | Scope page. This list must be URLs/targets separated by newlines.

Both the Include in scope option and Exclude from scope option are case insensitive. /javascript/, /JavaScript/, and /jAvAscrIPt/ all mean the same for the Target | Scope feature of Burp.

 

Quick settings before beginning


This section highlights five quick settings that can be enabled/set/configured before beginning a test to become productive immediately:

  • Enable server response interception: By default, Burp is not configured to intercept server responses. This can, however, be enabled using the Intercept Server Responsesoptions underProxy | Options. Enable interception of responses whenRequest|Was modifiedand whenRequest|Was intercepted.
  • Enable the Unhide hidden form fields and select the Prominently highlight unhidden fields option: This can be found under the Proxy | Options | Response Modification panel. This is very useful when browsing an application that stores or uses hidden HTML form fields to make application decisions.

The hidden field is visible on the page and highlighted very conspicuously, allowing you to edit the contents directly in the page if required.

  • Enable the Don't send items to Proxy history or other Burp tools, if out of scope option: This option can be found under Proxy | Options | Miscellaneous. When enabled, this option prevents Burp from sending out-of-scope requests and responses to the Proxy | History and other Burp tools, such as Scanner and Target. These requests and responses are sent and received, but not logged in any of Burp's feature sets.
  • Set a keyboard shortcut to issue a Repeater request: This is a very useful setting that can be enabled to avoid clicking the Go button using the mouse when working with the Repeater module of Burp. Burp already allows items to be sent to Repeater via the Proxy | History tab using Ctrl + R. Switching to the Repeater window can be achieved with Ctrl + Shift + R. Adding a shortcut to sending a request using Repeater completes the chain of keystrokes required to pick an item from Proxy | History, and sending it forward.
  • Schedule a Save state operation: Burp has a task scheduler that can be invoked for certain tasks, such as resuming and pausing scans and spidering. You can reach the task scheduler from Project Options | Misc | Scheduled Tasks.
  • One of the key operations that the task scheduler supports is the auto save state. Select Save state and click Next:
    1. Select a file that will contain the save state and, if required, select the In-scope items only checkbox, as shown in the following screenshot:
    1. Select when to start the task and the interval. During a busy engagement, saving every 30 minutes is a good interval to begin with:
    1. Click finish to activate the Scheduled Task, as shown in the following screenshot:
 

Summary


In this chapter, we learned to prepare the Burp Suite application. We configured Burp Suite to make it the interception proxy for various clients and traffic sources. In the next chapter, we will learn how to configure the client and set up mobile devices.

About the Authors

  • Carlos A. Lozano

    Carlos A. Lozano is a security consultant with more than 15 years' experience in various security fields. He has worked as a penetration tester, but most of his experience is with security application assessments. He has assessed financial applications, ISC/SCADA systems, and even low-level applications, such as drivers and embedded components. Two years ago, he started on public and private bug bounty programs and focused on web applications, source code review, and reversing projects. Also, Carlos works as Chief Operations Officer at Global CyberSec, an information security firm based in Mexico, with operations in the USA and Chile.

    Browse publications by this author
  • Dhruv Shah

    Dhruv Shah holds a Masters degree in IT and has 7 years of experience as a specialist in Information Security. He started off as a trainer sensitizing staff in private sector organizations about security issues and what hackers look for when they launch attacks on networks. He, later on, switched his job to carry out penetration testing for Indian government agencies and then for banking clients in the Middle East. He now has extensive experience in penetration testing for Fortune 500 companies involving web and mobile applications, networks, Infra, and Red Team work. In his spare time, he co-authored the book Kali Linux Intrusion and Exploitation and is an active member and moderator of one of the Null chapters in India.

    Browse publications by this author
  • Riyaz Ahemed Walikar

    Riyaz Ahemed Walikar is a Web Application Pentester, security evangelist, and researcher. He has been active in the security community for the last 10 years. He is actively involved with vulnerability research in popular web applications and network aware services and has disclosed several security issues in popular software like Apache Archiva, Openfire, and so on. He has found vulnerabilities with popular web applications like Facebook, Twitter, Google, and so on for which he is on the Hall of Fame for most of these services. He has also been a speaker and trainer at several security conferences. His technical interests lie with programming, bug bounty, malware analysis, breaking web applications, playing CTFs, and penetration testing networks.

    Browse publications by this author

Latest Reviews

(2 reviews total)
None Yet.
**** book, poorly edited. Packt gave me problems regarding a refund but eventually came through. If you're going to publish technical books the editing should be solid. This one's was not. To give but one example, the book uses screenshots from two different versions of Burp, 1.7 and 2.0. That's very confusing when you are trying to learn.

Recommended For You

Hands-On Application Penetration Testing with Burp Suite
Unlock this book and the full library for FREE
Start free trial