Hack Like a Pro with Burp Suite

/pavanw3

b

What do you learn?

I’m a boring geek Burp Suite is your best friend Some really cool tweaks

~$ whoamipavanw3b Yet another w3bAppSec guy break-fix-repeat Security Engineer @ ServiceNow

Who’s an expert here?

More than an interception proxy

Burp Suite

Start like a Pro$ java –jar –Xmx4G /path/burpsuite.jar

• Let burp use up to 4GB• Default can be as low as

128MB• But not more than 4GB

Better Proxy-ing

Global Just Firefox Moody?FoxyProxy

Focus on Target It’s your Desktop Set better Scope Compare Site maps Drop out-of-scope Options > Connections

Better Filter Target See In-scope items Hide not-found Demo

Playing around Proxy Play around Message Analytics

Can also contain XML, AMF & View State

Intercept Request Intercept Response HTTP history: Params & Filter Unhide hidden form fields

Exploiting with Intruder

Send lots of data & make sense of response Username Enumeration, Directory Fuzzing – XSS, SQLi, Path traversal Add payload: FuzzDB, WebAppURLs, OWASP DirBuster Demo: Save & Load attack Config

Stay calm & use Scanner

Passive Scanning Active Scanning Use wise! Crawl -> Scan Demo Don’t make too fast Be in-scope

Never miss anything - Repeater

Scratchpad Demo Change the way you want it Try OPTIONS

The good Spider Create lots of Pollution Form Submissions Do after manual Crawl Demo Some are only on Prod: robots.txt Careful - Delete all users Control threads

All about tokens - Sequencer

Test how random it is.. Session, CSRF, Password reset etc

Min 100 tokens required

Find the secret - Decode

No Key - No Security Encode != Security Demo Send to Decoder

Confused? Use Comparer

Compare responses Blind SQLi Compare by

Words Byte

Byte: Computationally costly Demo: Compare 2 responses

Engagement Tools

Search Find in Comments, Scripts, Ref Analyze Target Discover Content

Wanna add? Extender Jython, JRuby etc BApp Store

java.lang.OutOfMemoryError?

java -XX:MaxPermSize=1G -jar burpsuite.jar

Maintenance Save State

Save in-scope only Restore State

Don’t restore from untrusted sources Auto backup Schedule Task: Save State - Creates only 1file

Some more if you need

Right click & you got all Shortcuts: Options > Misc > Hotkeys

References & Reads Burp Suite Essentials by Akash Mahajan

10 Unbeatable Features of Burp Suite Pro Official Documentation Pen Testing with Burp Suite Real life tips & tricks

Am I really

boring?

Pavanhttp://pavanw3b.comfb/pavanw3b | @pavanw3b