Mastering Burp Suite: A Comprehensive Pentest Course

Burp Suite for Penetration Testing

# Section 5: Advanced Usage of Burp Suite for Penetration Testing ## 1. Installation and Configuration on Kali Linux ### 1.1 Installation Steps Burp Suite is pre-installed in Kali Linux, but ensuring that you have the latest version is crucial for effective testing. Below are steps to install or update Burp Suite on your Kali Linux environment: 1. **Open Terminal**: Launch the terminal in Kali Linux. 2. **Update Repository**: Ensure that your system is up to date. 3. **Install Burp Suite**: If Burp Suite isn’t installed, you can install it using: 4. **Launch Burp Suite**: You can start Burp Suite by typing: 5. **Activate Burp Suite Pro (if needed)**: If you have a licensed version of Burp Suite Pro, follow the activation process through the GUI. ### 1.2 Configuration #### 1.2.1 Initial Configuration Upon launching Burp Suite, you will be prompted to choose an option: – Temporary project – New project on file – Open an existing project For most pentesters, a **New project on file** is recommended. #### 1.2.2 Proxy Configuration 1. **Burp Proxy** is a crucial feature allowing you to intercept and modify requests between your browser and the target application. 2. **Browser Configuration**: – Open your web browser’s network settings and configure it to use a manual proxy configuration. – Set the HTTP proxy to `127.0.0.1` and port to `8080`. 3. **Adjusting Browser Certificate**: To avoid SSL issues when intercepting HTTPS traffic, download Burp’s CA certificate: – Navigate to `http://burp` in your browser. – Download the CA certificate and install it in your browser's trusted root certificate store. ### 1.3 Advanced Configuration – **Target Scope**: Define target scope in Burp Suite to avoid accidentally attacking unintended systems. – **Intruder Settings**: Configure payloads and attack types based on your requirements (e.g., Sniper, Battering Ram, etc.). – **Extensions**: Utilize the BApp Store within Burp Suite to install additional features that enhance your testing capabilities. ## 2. Step-by-Step Usage and Real-World Use Cases ### 2.1 Intercepting Traffic #### Step-by-Step Guide 1. Start Burp Suite. 2. Ensure your browser is configured with the proxy settings (as described above). 3. Navigate to the target web application in your browser. 4. In Burp, go to the Proxy tab and enable intercept. You'll see requests being captured here. #### Real-World Use Case Suppose you are testing a banking application. You could intercept a POST request when the user submits their login credentials. Modify this request to test how the application responds to various username and password combinations. ### 2.2 Scanning for Vulnerabilities #### Step-by-Step Guide 1. In the **Target** tab, add the target site to your scope. 2. Navigate to the **Scanner** tab. 3. Right-click the target and choose to scan it for vulnerabilities. #### Real-World Use Case When pentesting a content management system (CMS) like WordPress, use Burp's scanner to identify vulnerabilities such as SQL injection or Cross-Site Scripting (XSS) in the input fields of user login or comment submission forms. ### 2.3 Using Intruder for Automated Attacks #### Step-by-Step Guide 1. Within the Proxy tab, right-click the request you want to automate, then select "Send to Intruder." 2. Move to the **Intruder** tab. 3. Select the positions of the payloads (e.g., username and password fields). 4. Configure your payloads in the **Payloads** tab using a list of common passwords for a brute force attack. [/dm_code_snippet]markdown # Sample WordPress Login Brute Force Attack using Intruder 1. **Set Positions**: – Highlight the username/password fields and add them as positions. 2. **Add Payloads**: – Add a list of known usernames and passwords for the attack. 3. **Start Attack**. [/dm_code_snippet] #### Real-World Use Case Using the Intruder feature, you can conduct a brute-force attack against a WordPress login page to test the strength of user credentials and alert the admin about weak passwords. ### 2.4 Fuzzing for Input Validation Fuzzing is a critical technique for testing input validation. Burp Suite allows you to automate this process through the Intruder or Repeater. #### Step-by-Step Guide 1. Send a request to the Repeater. 2. Modify the parameters you wish to test. 3. Utilize a payload set that includes various inputs designed to break the application (e.g., special characters, SQL commands). [/dm_code_snippet]markdown # Fuzzing Example 1. **Send Request to Repeater**. 2. **Modify Parameters**: – Change a parameter to `' OR '1'='1`. 3. **Send and Observe Response**. [/dm_code_snippet] #### Real-World Use Case Fuzz input fields of a web application to identify improper input handling. For example, inserting SQL query strings in a search field could help determine if the application is vulnerable to SQL injection. ## 3. Detailed Technical Explanations and External Reference Links ### 3.1 Burp Suite Features Overview – **Proxy**: Intercepts traffic between browser and application. – **Intruder**: Automates attacks on web applications. – **Scanner**: Automatically scans for vulnerabilities. – **Repeater**: Allows you to manually modify and resend requests. – **Decoder**: Supports encoding/decoding various types of data. – **Comparer**: Highlights differences between two pieces of data. For a deep dive into the features of Burp Suite, refer to the official documentation: [Burp Suite Documentation](https://portswigger.net/burp/documentation) ### 3.2 Understanding Web Application Vulnerabilities 1. **SQL Injection**: Occurs when an application allows untrusted data to manipulate SQL queries. – Reference: [OWASP SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection) 2. **Cross-Site Scripting (XSS)**: Involves injecting malicious scripts into web pages viewed by others. – Reference: [OWASP XSS](https://owasp.org/www-community/attacks/xss/) 3. **Cross-Site Request Forgery (CSRF)**: Tricks users into submitting requests they didn’t intend. – Reference: [OWASP CSRF](https://owasp.org/www-community/attacks/csrf) ### 3.3 Additional Tools and Extensions – **JWT Editor**: Modify JSON Web Tokens for testing authentication. – **SQLMap**: Automate the process of detecting and exploiting SQL injection vulnerabilities. Utilize the BApp Store in Burp Suite to explore and install these extensions. ## 4. Code Examples for WordPress Pentesting ### 4.1 Example: Exploiting a Vulnerable Plugin Assume there's a vulnerable plugin installed on WordPress that doesn't sanitize user input properly. You might use Burp Suite to inject a payload. [/dm_code_snippet]markdown # Payload Example for Testing a Vulnerable Plugin 1. **Intercept Request**: Use Burp Proxy to capture the request to the vulnerable plugin. 2. **Modify Payload**: Change the request body to include a malicious payload: [/dm_code_snippet]sql 1' OR '1'='1'; — [/dm_code_snippet] 3. **Send the Request**: Observe the response to check for vulnerabilities. [/dm_code_snippet] ### 4.2 Example: Testing for Default Credentials Testing for default WordPress credentials can be done via Burp Suite's Intruder. [/dm_code_snippet]markdown # Login Testing with Intruder 1. **Prepare the Login Form**: – Set positions for username and password. 2. **Payload Options**: – Use commonly known default username/password combinations: [/dm_code_snippet]plaintext admin / admin admin / password user / user123 [/dm_code_snippet] 3. **Run the Intruder Attack**: Launch the attack to identify successful logins. [/dm_code_snippet] By utilizing Burp Suite and the techniques covered in this course section, you can effectively conduct penetration testing against web applications, particularly those using the WordPress platform. Always remember to get explicit consent before testing any application and adhere to ethical guidelines. — Made by pablo rotem / פבלו רותם