Welcome back, everyone.
This is, again, one more interesting course for you, this is the goes on but sweet and for those
who are not aware about bup bup, so it is application security to a testing tool, basically, and
it's sort of a proxy server.
But do more than that, right.
It do all those security testing stuff and widely being used by bug bounty, widely used in the bug
bounty programs basically.
All right.
So toward the scores, we'll learn a lot of about how the bug backbone of how the web applications got
throughout that course will learn more about how the platform really works, how it involved them to
plan to sever the relationship and communications.
What are the different features being used by a lot of people involved in the bug bounty?
And what are the different features can be used for security testing and will go even more further.
All right.
So without taking much time, let's get started.
So before we go ahead, we'll also first understand the fundamentals and basic idea about how how the
boxwood really works more than the proxy mechanism.
So let's understand this.
Let's have a quick intro about Bob.
So, Bob, so it is basically a proxy server, as I told you earlier, but developed for application
security testing and developed by a company, Balsiger.
And if you look at it, the fundamental or the mechanism of client and server communication is all done
by all starts with users sending request to a Web application.
Right.
Sending a request to the Web application.
And it could be a certificate request or post or whatever it is.
And from the from not itself, the communication starts.
Right.
If it asks for and you want to maybe dub, dub, dub, Google dot com and get the response coming back
that Google wonderful Google doodle as well.
And that's how the client server communication really works.
But when you have a proxy in between the things changes and the user never understand, you know, what
will happen and not even Web server it just that the proxy has to be changed in the user browser so
that all the traffic, which was earlier going directly, straight away to the Web server, now it has
to go via proxy server.
Now it's up to proxies server if it can allow the request to go to the server or not.
Now, who manages it in order to manage a proxy server?
There are sys administration administration team in the organization who make sure what what group of
users should be allowed to access these applications, this Web application, or maybe these sites.
And some of them may not be.
So this is called you are filtering out of figuring that out.
Many dos for there are many open source tools.
Firewalls also do those jobs as well.
So but they exist.
These are mainly used to have a complete control over that activity of their employees.
They ask for their corporate policy that maybe they don't want to allow social media content.
Maybe they don't want to allow any Web application websites outside of their territory or maybe country
itself.
So it's all up to them.
But now, when you choose sort of sweet proxy, your purpose is more than that.
Your purpose is to have complete control over our user activity at the same time using those request,
modifying those requests and sending it back to the server.
This is the job of Bob Sweet and that's what makes the book so unique and the tahboub.
So it makes it beautiful because what's really happened is the user send the request to the server and
once it goes wyborcza it up so it can, we can take this request, can modify it and then give it back
to the Web server.
And in that case, what happened is Bob, so it can modify multiple times and it is modified by the,
you know, people who are managing it.
And every time whenever we modify the request, we can see what's the response coming back.
And it sounds exactly like quality testing and software testing program itself and actually does some
something like this.
But it is more focused on security aspects of it, like a school education, crosseyed scripting, a
blind injection, all the stuff, right.
So that is what we are all going to talk about.
Let's get an understanding about it features a bit.
And this is how the dashboard really looks like.
And the basic idea is they allow you to edit the request sent to the Web server, I mean website where
it says through your Web browser, in fact, and it has a feature called Repeater.
But through Peter, you can actually read or you can actually repeat the request, which has been sent
earlier.
So you can recreate the situation and understand if the request was sent for the mobile phone as the
agent.
Now it can it can make the Egin it can change the agent information with maybe Windows or Firefox or
Chrome or something and get to see what the response comes back.
Right.
And it can also modify the EPA setting.
It can also modify any other information related to cookies or maybe maybe any other responses with
the Grinches or any any any other barometer's as well.
So in that case, what happened is we've with the repeater, we get to see if the response is not really
not really good enough maybe to not other than two hundred okaya four zero three or three hundred series
responses, something we get the idea.
What what is that any change and how does change happen or is there any security implications to it.
Right.
So that's all we do it for that then those intercept of course the intercept is just when you turn up
the intercept it actually intercept what all happening.
And it's up to you if you want to allow this request to the server or not.
If you drop that request, the user browser will get in.
No response on the browser.
But once you're done of the intercept, the request has to go to the proxy.
If you disable the intercept or the request directly goes to the website, even if you have a proxy
in between.
So in fact, and in a situation when you thought off the intercept, it bypassed the proxy and goes
directly with it.
All right.
So that's what it is.
An intruder.
Intruder is the one more interesting feature.
The purpose is basically majorly to not just about brute force attack, although I have mentioned this,
but major leaders for brute force attack.
And there are many as well.
In fact, discovering new APIs are kind of enumeration.
All the stuff even that is also one of the use case, but predominantly for brute force attack, wherein
you you want to see what all passwords or whatever possible you can try and attempt with or maybe a
combination of user and password.
But several attacks, you know, there could be category of attacks that you can possibly drive it with,
with the help of by marking those parameters and then applying the payload to each and every mockers,
in fact.
So I'll tell you about all those aspects.
So this is all about Bob Suite and from next lecture on which will understand about installation individuals,
individual features and will go more deep inside of it.
All right.
So I hope you like this lecture on it.
I will get you in the next one.
Thank you.