Hello, everyone.
So in this video, we are going to see what is Burpe suite and how to set up Burpe suite .
So we are going to first learn what is Burpe suite
Why are we going to use Burpe suite
What are proxy tools and the lab set up of Burpe suite for conducting further attacks?
So before starting with Burpe suite , I would like to tell you guys that Burpe suite is a proxy tool.
So what is a proxy and how a proxy works are going to see into this video?
As you can see on your left side, is the client and and the right side is the server.
And in between there is proxy sitting between the client and the server.
So the client sends a request to the server.
There is a proxy sitting in between, which is nothing but Burpe suite , which intercepts your request.
Also intercept your response.
So what does it do by intercepting?
Intercepting generally means whenever the client is sending a request, it will first go to the proxy
that is the Burpe suite .
And then when the interception is turned off, the request will go further to the server similarly.
And the server is sending a response back to the client.
The proxy, which is the Burpe suite , will capture the response and when we do intercept off, it will come
back to the client browser.
So this is how a basic proxy works.
It sits in between the client and the server and it sees whatever data is passing through in the request
or in the form of the response.
You can also call it proxy as man in the middle attack why?.
Because proxy is basically sitting between your computer and the server, so your data has been passing
to someone else and that someone else is your proxy and that someone else is Burpe suite .
So your data is going to pass through Burpe suite .
So you can also call this a MITM attack that is man in the middle attack.
Perfect.
So after understanding how a proxy works, let's see, how can we do the Burpe suite Lab setup?
So we are going to first see how we can set upBurpe suite and then how we can configure Burpe suite with our
browser after that, how we are going to do a proxy setup.
And then last we'll see how we can attack.
So it's the practical time, time to practice and let's see the practical setup of Burpe suite for setting
a Burpe suite .
Would you require two things?
The first thing is a browser.
And the second thing is Burpe suite itself.
So for the browser, I preferred Mozilla, Firefox, the latest version, you can you can also install
Mozilla Firefox.
While we are not going to use Google Chrome, Safari or Internet Explorer because of some type of compatibility
issues when we are setting a proxy, that is why we will only prefer Firefox as our main browser for
conducting all types of attacks.
So after a successful installation of Mozilla Firefox, or if you already have it installed, you just
have to go and search for Burpe suite onto Google.
After you search for Burpe suite , they will be the first link of port swigger dot net.
You have to just click on that, as you can see.
Welcome to the family.
That would be a last option.
That is community edition.
So basically, there are enterprise professional editions also, but those are paid editions.
So we are going to use a free edition to just click on Get the Community.
After clicking on there, you will see there is download the latest version so you can navigate here
and click on download the latest version.
After clicking on this, you can choose a required Burpe suite release version for your computer.
If you're using Linux, you can choose Linux.
If you're using Mac OS, you can use Mac works.
If you're using Windows, then you can use windows.
If you want a compatible version which can run on all the versions of your operating system, you can
download a version and which can run through Java.
So in my case, I'm running onto an Apple Mac OS, so I'm going to download Mac OS.
And I will hit on download, as you can see, it is of around 180 MB for my operating system, it were
ready for your computers.
You just have to save the file and click on, OK, I have already downloaded, so I'm not going to download
it again.
Perfect.
So now after downloading, you just have to start it and install it, installation steps are very simple.
You just have to do a couple of next, next, next and finish.
And it will get installed for Windows based computers, for Mac OS computers.
You just have to double click it Drag into your application folders and it will get installed.
Following its computer, the steps are seen as for the Windows computer, you have to do a couple of
next and then finish as soon as you have installed.
You can see this is the boxwood skin screen wearing bob suit will start.
So I'm just going to press next and then one more start.
Burp button.
As soon as you click on Start Burp, Boxwood will start.
And this is the first look on Bob Suit that how it looks.
This is basically the way that you are going to use a lot.
So you should get familiar with this user interface.
So as you can see, there are a couple of times at the top, there is burb into the repeater window,
help, then there are a couple of tabs over the years we are going to use most of the tabs into our
attacks.
So the first and very important is the proxy type that you have to configure.
So I will quickly go onto the proxy to I will just click on it.
After clicking on this tab, you can see there are further more tabs for subtypes.
You can see first as intercept.
Second is HTP history, this WebSocket history.
And the last one is options.
As you can see, I wanted the first subtype that is intercept Riganti.
There are more things over here.
Forward, drop intercept is on and action.
All the three are disabled right now.
Only this one is Annable and it is on intercept.
On basically means whenever a request is going from your computer to any server, you can capture that
request into Boxwood and see whatever is going to the server.
Similarly, whatever is coming from the server can be captured into batsuit and you can see the response.
Also, we are going to use this in the later parts of the video.
For now, we'll just quickly set up our batsuit.
So I will just turn this off and I will go into the last option, I will just show you what is the next
step in history, A.P. history, that just takes all the history of whatever you're running on your
browser.
Similarly, WebSocket history contains any WebSocket connections ever made.
Not relevant for us right now, for the start will quickly move on to the option.
Stop where you can see that the first thing is proxy lessness.
You just have to select the proxy and you have to click on edit.
So my proxy is a Lubeck IP and is 127, not 0.01.
And there is a board member that is eight zero eight zero.
The application by default vildan on board zero eight zero.
But I want to change this board because maybe and some computers there may be some service running on
eight zero eight zero because sometimes the developers use this Dysport member to test for their some
of the demo applications to run.
So this may this may give some problems.
So just to avoid that, we are going to change the board number and stay on the safe side.
So we are going to make the port numbers eight zero eight one and click on.
OK, so we have successfully changed the board number and you can see there is a tegmark on running,
which means our proxy is running successfully.
After setting this up, I will just go back to the intercept tab and now I'm going and I'm going to
go to the Firefox browser.
Now it is time to configure the browser because we have already configured the Boxwood in browser.
You have to click on these three dots and the right top and you have to move to the preferences tab
for Windows based computers.
It will be named as options for Linux and Mac OS users.
It is named as preferences.
After going in preferences, you have to search for proxy.
You have to type your proxy and you'll be able to see there is an option called settings.
I just have to click on settings and there are four options over here.
The first option is no proxy or reject proxy use system, proxy and manual proxy.
So you have to choose, choose the last option.
That is the manual proxy and you have to configure the proxy or whatever and the board number over here.
Remember, you have to put the board number that you have selected into Boxwood.
So I have selected eight zero eight one.
So I'm going to type it into it when you can take any number that you want and you can configure in
Bob as well.
As yet, for example, you can configure board number one, two, three, four and Boxwood as well as
one, two, three, four into your browser.
After doing this board number and the Lubeck IP, you have to click this, you have to check this that
used this proxy for FPP and HGP.
Also remember that is important that you checkbox this option.
Then you have to click on OK, and now we are going to test that our browser is successfully configured
with Boxwood are not so far that we just have to open a new tab and type HTP colon slash, slash, burp
and enter if you are able to see the screen, which is a green screen screen, and then which means
your bob is successfully configured.
Perfect.
So Bob is configured now we have to install a Sears certificate into our closer to make Burke capture
the requests.
So for this, you just have to click on this, see a certificate, and then you have to save the certificate.
After saving, you can see I have already downloaded 12 times, so this is the 12th download that has
happened into my computer.
Now I will again go to the preferences or settings you can see and I will search for cert as we have
to install the certificate here.
I will click on View certificate and in the authorities tab.
That is the last time I have to go in the import button at the bottom, as you can see over here.
I will see the part of the certificate, the certificate is over here.
I will just click on import and I'm going to search for the certificate that I have downloaded.
I have downloaded Sartwell, so I will just import that.
And you can see in my computer it is already installed.
So the same certificate is already installed.
But in your computer, if your konforti configuring this for the first time, it will ask you, do you
trust the certificate?
Then you have to check box twice.
There will be two check boxes, you have to check box, you have to take both the check boxes, which
means you trust that certificate and you have to press enter as I have already done that I'm not I don't
have to do that again.
And the certificate is already installed into my computer.
Perfect.
Now, our most successful configuration has been done, and let's verify if we are able to intercept
or not.
So I will just go into my bubp and click on Intercept on and I'm going to search for Google dot com.
There is an error.
Let me verify.
The proxy is running perfectly fine.
And Bob, let me see into my settings of browser.
Let me just a proxy and you can see.
Yep.
So I missed checking this.
As I said, it is very important.
Let me hear it.
OK, and let me try to reload this.
Let me go to Bob and check if it is working fine.
And you can see it is working fine.
I have got the request of Google dot com into my computer as I made a request on my browser.
I have captured the request into the Boxwood, which is the proxy.
Now, as you can see, there are these options.
Forward drop and action, as you must have understood forward means to forward this request that I've
captured to the server.
Dropped means drop the request and in between the request will just die and action.
We are going to see in further videos.
So for now, I'm going to make it forward.
So the request will go to the server and the server is going to send the response back to a computer.
So let me just search for Batmen going batsuit and then hit enter over here.
The request must have passed through the proxy and we have captured the request.
And Boxwood, let's go to Bob Suit.
And this is the most helpful feature of Bob Suit and built at the bottom.
As you can see, this is a search bar.
You can just search for anything into your request that has been going.
So I'm just going to search for Batmen and this will automatically show if it matches into this request.
So Batman is not matching, as you can see, zero matches.
I'm going to forward this request.
Perfect.
As you can see, Batman is matching at two places and you can see two matches found.
So I'm just going to replace Batman with Superman.
In the request, so I've changed this, and after changing, I will just forward this request to intercept
off and go to my browser.
As now you can see I searched for Batmen through my browser.
But when the request came to my proxy, that is the suit I modified the request to Superman.
This was a very basic example of how you can capture your request and how you can modify your request.
Similarly, we can modify our responses.
That is coming from the server that will see in the videos.
We will do attack for response manipulation.
I hope you guys understood how to set a suit into your computer.
If you have any doubt, you can post your doubts in the discussion session.
I will help you guys how to set up Boxwood.
Thank you.