Lecture Notes: Burp Suite Overview and Demonstration

Introduction

• Presenter: Daniel from ITProTV.
• Focus: Demonstration of Burp Suite, a tool for web application testing.
• Burp Suite is known as the gold standard for web app testing.
  • Two versions: Community Edition (free), Professional Edition (paid).

What is Burp Suite?

• A tool used primarily for web application security testing.
• Often found in penetration testing distributions like Kali Linux, Parrot.
• Useful for inspecting and manipulating web app data.

Setting Up Burp Suite

• Demonstrated on a local test lab using Virtual Machines (Kali and BWapp).
• Start Burp Suite via Kali Linux interface.
• Configure Burp Suite with proxy settings:
  • Use plugins like FoxyProxy for easier setup.
  • Install CA certificate for HTTPS support.

Starting with Burp Suite

• Project Creation: Community Edition only allows temporary projects.
• Target Setup: Define the scope to avoid unnecessary data collection.
• Basic Navigation:
  • Dashboard: General overview.
  • Proxy: Intercept and manage web traffic.

Important Tabs and Tools

• Repeater:

  • Used for testing repeated requests to web applications.
  • Allows modification of requests before sending.

• Intruder:

  • Used for automating attacks like fuzzing inputs to test for vulnerabilities.
  • Limited in Community Edition due to throttling.

• Decoder:

  • Encode and decode data (e.g., base64, URL encoding).

• Extender:

  • Add functionality via plugins from the BApp Store.

Demonstration Highlights

• Intercepting and Modifying HTTP Requests:

  • View and alter headers, cookies, and parameters.
  • Example: Change user agent strings, manipulate cookies.

• Session Handling:

  • Capture session cookies for further testing.

• SQL Injection Example:

  • Using Intruder to test SQL injection vulnerabilities in login forms.
  • Explained concepts like fuzzing, payload manipulation.

• Insecure Direct Object Reference (IDOR) Example:

  • Demonstrated exploiting a flaw to manipulate ticket prices.

Learning and Resources

• Foundational Knowledge: Understanding web technologies (HTTP, HTML, JavaScript) is crucial.
• Training Recommendations:
  • PortSwigger Academy: Free comprehensive training on Burp Suite and web app testing.
  • ITProTV: Courses incorporating Burp Suite usage in broader penetration testing contexts.

Conclusion

• Burp Suite is a powerful tool for web application security testing.
• Key to effective use is understanding the underlying web technologies and how to manipulate them with Burp Suite.
• Importance of continuous learning and experimentation emphasized for proficiency.