Getting Started with Burp Suite

Getting Started with Burp Suite

Burp Suite is a very powerful tool for manipulating websites to find vulnerabilities. The community edition will work fine but is much slower than the Professional version. You can use the community edition to learn however if you are serious you should support the product and purchase it ($400/year). Worth mentioning, the Enterprise version has CI Integration which is really useful for DevSecOps.

https://portswigger.net/burp

Installation/Upgrading on Debian/Ubuntu

Installation is fairly easy, you just need to make sure Java 8 is installed and then install BurpSuite.

Upgrading on Kali/Parrot OS/Debian/Ubuntu

If you are using Kali/Parrot OS and you just want to upgrade Burp Suite running the command below will do that.

Debian Installation

Fresh installs require a little more work. You will need to verify that Java 8 is installed.

Windows Installation

Downloading and installing Burp Suite on Windows is as easy as downloading and installing.

PortSwigger.net: Download Professional / Community

FoxyProxy Browser Extension

This is the best browser extension to use for switching between proxies. There are others out there but this one is the easiest to set up and use. It’s very intuitive.

Add to FireFox

FoxyProxy settings for Burp Suite is really easy… Set the “Proxy Type” to “HTTP”, “Proxy IP Address” to “127.0.0.1” and the “Port” setting to “8080”.

Installing the Root Certificate

You will need to install the root certificate for SSL in order to use Burp Suite on a website that is using an SSL.

http://127.0.0.1:8080 or http://burp

Burp Suite Payloads

You’ll need these for LFI, SQLi, User-Agents and XSS testing. These are free text files that are payloads that Burp will run against a website or endpoint to test.

https://github.com/danielmiessler/SecLists/tree/master/Fuzzing
https://github.com/swisskyrepo/PayloadsAllTheThings

Burp Suite: Intercept, Repeater and Manual Manipulation

Being able to intercept and manipulate requests is one of Burp Suite’s hallmark functionalities. This is great for tampering with product pricing or a shopping carts total to see if the backend is even validating products and totals. Imagine being a hacker and changing the price of your order or gaining administrative access by tampering with post variables.

Burp Suite: Brute Forcing with rockyou.txt

Burp Suite can even brute force forms by using a wordlist dictiionary like rockyou.txt. This is a feature that you should only use in Burp Suite Professional. The community edition will work but it’s extremely slow because it has a speed reduction by design.

In this demonstration, I’ll be using VulnHub: DC 4.

FoxyProxy

First, you’ll need to make sure your traffic is being proxied through Burp Suite.

Capturing a Request

To start off, I will enter some random information into the username and password field such as “admin” and “password”. With Burp Suite listening for proxied traffic I should be able to intercept a request.

Great! I’ve intercepted a request to Burp Suite.

Right click anywhere in the center and then select “Send to Intruder” from the context menu.

Configuring the Intruder (Clusterbomb)

The first thing I’m going to do is clear the predefined fields (teal blue highlighted fields). Then reapply that to admin and password. The PHPSESSID is fine and we do not want that to change. We only want to map data to the username and password field.

Your settings should look like this now. You will also need to select “Cluster bomb“. This allows for multiple payloads.

Setting up the Payloads

At this point, there will be 2 payloads. The first payload set should be “admin” and “administrator” since we don’t know the admin’s username. The 2nd payload will be the passwords. Loading the rockyou.txt is possible if you have enough ram, however it’s an incredible amount of passwords in the dictionary and will slow down Burp Suite enormously.

Running the Attack

Everything is ready for the attack. Once the attack has been started you can see that it will alternate between “admin” and “administrator” while trying each password once. Once the HTTP status and Content Length changes we will know that something has happened. Looking at the image below, I see that the content length is 660 which is not like the others. I also noticed that all of the HTTP statuses after a certain point were 200 (success). By clicking on the request 925, I can also see in the HTML response that it says “You are currently logged in”.

I tried logging in with “admin” and “happy” and it worked. Password cracked!

Burp Suite: SQL Injection

Manual SQL injection testing can be done using a payload or in an automated fashion the scanner will check.