You may want to check out more Mac applications, such as iWeb Action Pack, AskKey or SDMInst, which might be related to BurpSuite. Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security vulnerabilities.
Table Of Content
- 1 Burp Suite Tutorial
- 1.1 What is Burp Suite?
- 1.1.2 Target –
- 1.1 What is Burp Suite?
One tool that can be used for all sorts of penetration testing, either it be using it to manipulate the packets to buy stuff for free or to carry out a massive dictionary attack to uncover a huge data breach. It’s always a dream for hackers to have such a tool in their arsenal. What if I can tell you such a tool is not just fantasy but it’s present out there right now. Burp Suite is one such that tool that I have come across in the past few years of my penetration work and I have always wished to have known about it earlier.
Burp Suite seems like a complex tool in the beginning but here let us take it down one by one to properly understand what the tool does and how we can make the most out of the tool.
Burp Suite comes in two different versions, one is the community version ( this is for free ) and the other one is the professional version ( it is paid, but worth every cent ).
In the upcoming article, I will try to cover the professional version as that will encompass the community version.
What is Burp Suite?
Well, as the name suggests its a suite of tools bundled together.
Burp has many features built right into it, either it is a proxy tool that lets you manage and see every request and response packet that is send and received by your browser or be the feature to carry out a brute force or dictionary attack.
As I mentioned earlier we will learn its function one step at a time. Burp Suite has been divided into various tabs.
To make proper use of the tool Burp Suite we need to learn how to utilize all these different features in sync, then we will be able to make the most of it.
Remember one thing about Cybersecurity, the biggest hacks are never the one big hack in itself they are actually a group of smartly carried out small hacks.
Download Burp suite via Clicking here.
Suites in Burp! 😛
As I described before Burp has been divided into various different tabs. First, let us walk through those different tabs to have a bird’s eye view of the whole tool and what all it is useful for.
These are as follows:-
- Target
- Proxy
- Spider
- Scanner
- Intruder
- Repeater
- Sequencer
- Decoder
- Comparer
- Extender
- Project Options
- User Options
- Alerts
Now, first let me tell you that not all of them will be as useful as the other. In my experience, the ones that I have used the most are the first seven, but that’s just personal preference.
Depending on the type of attack vector you are focusing on or what information you need, you will have to dabble in different fields.
Let me give a brief description of these features
Target –
This is the first feature you will come across once you have completed the setup. Target has two different tabs built in the Site Map and Scope.
They have further different sections built inside of it for different purposes to enhance the productivity while you are hunting for the bugs or carrying out a bug testing.
> Site Map –
This tab will be one of the most useful ones as it provides you with a list of domains that you have visited while you are browsing the web.
Once you select a domain that will present you with the sub-domains that you have visited in that particular session. There are different sections that especially focus on the request and response packets.
The professional version of it also gives you automated advise regarding what particular vulnerabilities might be present in the website.
> Scope –
It is always better to utilize this functionality while carrying out bug testing or pen-testing for a corporation where they only allow you to access certain servers and domains.
It is really helpful as it helps you manage the extra clutter that arises when you visit the websites and lets you focus and get the work done in the time frame.
Proxy –
This is the most important feature of Burp Suite that you will be using all along. This is the tab under which the packets that you receive and the packets that you send out pass through, hence the name proxy.
It will be the most vital tool under Burp Suite because it lets you see the packets, the headers and the information present in it.
It doesn’t just end there, it also allows you to edit these packets, which is a feature that you will appreciate with time as you use it.
Spider –
This tool I haven’t used much, but its really useful when you have a defined scope to work on. Spider automatically traverse through all the domains and sub-domains present under your scope.
This gives you an idea of how many domains are present in the scope and you can carry your pen-test on.
It is really required as you need to find bugs extremely quick so that you do not waste your time nor the time of your customer.
Scanner –
This tool helps you scan the webpage of the client and figure out the problems that it might be containing. It helps you scan the ports of the web server.
This will give you a basic understanding of the ports that are open on the server. and for what particular reasons the server might be being used for, give you an idea of the types of attack you can launch.
Well, seeing how long the article is turning out to be I will be describing the features of all the leftover tabs and what they are used for in the next upcoming article.
So, be on the watch and remember it’s not about the tool the hacker uses, but it’s about how efficiently he can use the tools he wields.
So never stop learning and playing around with your tools, cause you never know how it might come in handy. Read Second Part Here:-Burp Suite Tutorial | Complete Guide to Burp Suite Part 2
If you enjoyed it please do visit us again and happy hacking! 🙂
Author: Aditya Anand is a Cybersecurity enthusiast and Researcher in the field of WebApp Penetration testing. Contact here
Burp Suite Professional 2020.9.1 Build 3995Burp Suite Professional 2020.9.1 Build 3995 | 367 MB | Language: English
Burp Suite is a reliable and practical platform that provides you with a simple means of performing security testing of web applications. It gives you full control, letting you combine advanced manual techniques with various tools that seamlessly work together to support the entire testing process. The utility is easy-to-use and intuitive and does not require you to perform advanced actions in order to analyze, scan and exploit web apps. It is highly configurable and comes with useful features to assist experienced testers with their work.
The main window displays all the available tools you can choose from and set each ones settings the way you want.
Being designed to work alongside your browser, the application functions as an HTTP proxy, thus all the HTTP/s traffic from your browser passes through the utility. This way, if you want to perform any kind of testing, you need to configure the browser to work with it.
The first thing you need to do is to confirm that the apps proxy listener is active. Simply navigate to the Proxy tab and take a look in the Proxy Listeners section. You should see an entry in the table with the Running check box ticked. The second thing you are required to do is to configure your browser to use the apps proxy listener as its HTTP proxy server. Finally, you need to configure the browser to be able to send HTTP requests through the app without problems.
Burp Suite Download Windows 10
The previously mentioned utility gives you complete control over all of the actions you want to perform and get detailed information and analysis about the web applications you are testing. Using tools such as Intruder, Repeater, Sequencer and Comparer you are able to carry out different actions with ease.
With the help of Spider, you can crawl an application to locate its content and functionality. You are able to add new scope by selecting the protocol and specifying the host name or the IP range. Then the utility monitors all the transferred bytes and queued requests.
The Intruder tool enables you to perform attacks against web apps. Simply set the host name and the port number, define one or more payload sets and you are done. You can also use the HTTP protocol by checking the proper box from the Target tab.
Another tool that automates testing tasks is called Sequencer, which analyzes the quality of randomness in an applications session tokens. Firstly, you need to load at least 100 tokens, then capture all the requests.
Overall, Burp Suite Free Edition lets you achieve everything you need, in a smart way. It helps you record, analyze or replay your web requests while you are browsing a web application.
Features of Professional Edition:
– Burp Proxy
– Burp Spider
– Burp Repeater
– Burp Sequencer
– Burp Decoder
– Burp Comparer
– Burp Intruder
– Burp Scanner
– Save and Restore
– Search
– Target Analyzer
– Content Discovery
– Task Scheduler
– Release Schedule
Whats New : https://portswigger.net/burp/releases
Homepage: https://portswigger.net/
Burp Suite Online