Welcome to the video finding website vulnerabilities with burp in this video we will install and configure
a web site security testing tool called burp configure our browser to proxy all Web site traffic through
burp so that we get a much richer look at what Web sites are doing behind the scenes and we'll use burp
to attack an intentionally vulnerable Web site called the juice shop.
Well I'm sad to say this but we've arrived at the final video of this course.
And yet at the same time I'm excited because we're going to take everything we've learned and use it
to discover vulnerabilities in Web sites and exploit some of those vulnerabilities.
Before we do that though we've got a bit of prep work to do.
We're going to configure a tool called burp suite which is an incredibly popular tool for web application
penetration testers.
In fact I would say if you're going to seek out a career in web at Penn testing you absolutely should
purchase it.
Now there are a couple of different paid versions which you can read more about at Port Swygert dot
net.
Personally I use the professional version which costs a few hundred dollars a year but when compared
to other pen testing tools out in the market I consider burp very affordable.
For the purposes of this video though we can get away with using the free version of burp and we can
run up a few different ways.
In Cali it might be in your dock off to the left here by default.
We can also click the applications menu in the upper left of our Kelly box and we should see it right
in the main menu.
If it's not there check under the Web Application analysis menu.
When you run burp for the first time you may get this message.
That's because at least at the time of this recording burp works best with Java 8.
So I'm going to close all the windows that are open and then I'll drop to the command line and issue
the update tech alternatives space tac tac config space java command from the list that appears choose
the selection that corresponds with this path that I'm highlighting.
So I'll type 2 and hit enter.
Now I'll run burp again.
And we don't get the warning about Java but we do get a warning that a new burp update is available.
So our quick update now and then at the burp website.
I'm going to click the download link next to download for Linux.
Once the packages downloaded all located while I'm in terminal so I'm going to go to CD downloads.
And then if you remember from our last video I need to make this file executable so I'll tape S.H. maade
space plus X and then the name of my file.
And now if I do an ls again note that the file is green to show me it's ready to run.
I'll type slash and in the name of my sweet run file here.
I'm just going to click through all the menus and take all the defaults when the install wizard is done.
You can go to the install location which is slash Opt. slash burp sweet community and then run the burp
sweet community script to make things quick and easy.
I'm going to just click next to create a temporary project and then I'm going to go ahead and take all
the burp defaults as well.
And here we go.
We are ready to start using burp looking at the interface.
Now you might be scratching your head going.
So where's the click to scan button.
So this is probably the right time to emphasize that while burp does have some automatic scanning capabilities.
It's really meant to be more of a precision instrument for specific focused website security testing.
And while we're talking about that you should know that people have created hundreds of great YouTube
videos training courses blog posts and even books about burp.
In fact when I was first getting started with burp I read this book and it continues to be an awesome
resource not just for burp but for web at pen testing in general.
OK so before we can actually test a site with burp we need to configure our web browser to point to
burp because burp is essentially going to be our man in the middle as we test web sites and actually
I kind of like to think of Bert being a bouncer at a club.
Everybody who goes in and out of the club will be seen by the bouncer and if necessary the bouncer can
intercept people on the way in or out of the club.
How to set up our web browser to push traffic through Burke we'll go under Firefox preferences then
hit the Advanced tab.
Then network and then settings.
I'll turn on the manual proxy configuration point to the local IP of 1 2 7 0 0 1 and then set the port
to 80 80 which is what Burleson's on will click OK.
Now in Firefox let's try to go to a site like GWW.
Google dot com.
You may have noticed just a little flash of a window near the top of the screen that had the burp icon
next to it.
Let's head over to Birr.
And we now see that the proxy tab is highlighted as if to call our attention to it.
So let's click that
burp has an option called intercept which can trap requests as they come in and out of our browser.
Kind of like the bouncer example I gave you.
Basically right now burp is acting like a bouncer and is stopping every visitor at the door.
I just want to allow all traffic to flow in and out of my browser for now.
So I'm going to click the intercept is on button which will turn intercept off and if I flip back to
my browser will see that Google is now attempting to load properly.
But I'm getting a warning that my connection is not secure.
And that's because we're now pushing all our web browsing through burp.
So it's acting as a man in the middle to all our traffic.
What we need to do is import burps SSL certificate into our own Firefox browser store so that Firefox
trusts the cert and doesn't complain every time we visit a secure site to do that.
We'll just go to HTP colon slash slash burp.
And then on the right side of the screen we'll click the CA certificate to download it then I'm going
to go back into preferences.
I'll click Advanced then certificates and then view certificates from the window that pops up I'll click
Import then find this search we downloaded and then I'm going to tick the box just to trust this search
for identifying Web sites then I'll click OK to get out of any open menus.
Now if I try to refresh Google again it loads properly with no complaints about security.
And if we flip back to burp we see a ton of information here under the site map.
This is basically a mapping of all the domains and site content that have passed through burp.
It's kind of an unruly amount of information to look at.
So we'll definitely want to narrow our scope to keep our workspace more organized.
However before we do that we need a site to test.
Now we very well could head over to web scan test dot com like we've been using in a past video and
bang away on some of the vulnerabilities they've baked into that site.
But I have a feeling once you discover one vulnerability you're going to be hungry for a lot more to
find.
So I want to point you towards an amazing and free and intentionally vulnerable Web application called
juice shop.
You can find it pretty easily by just googling a wasp juice shop.
And if you do a bit of reading you'll see that juice shop is jam packed with common vulnerabilities.
You would find in real commercial apps today now to get it up and running the juice shop creators give
us several options.
We could set up a cloud instance of it in just a couple of clicks we could build it from source or install
one of several packaged distributions.
Personally I like running juice shop on a VM in my local LAN.
So what I've done is set up a Ubuntu server in VM where fusion on my Mac.
But of course you could use whatever your preferred virtualization software is such as virtual box or
VM Ware player.
And while this course won't cover installing the Ubuntu server these days it's really just about as
simple as downloading the install ISO booting to it in your virtualization software and then clicking
next a bunch of times.
And then what I'll do now is log into that server via S-sh and then I'm just going to copy and paste
the commands right from the setup guide
and next I'm going to open my browser to port 3000 of my Ubuntu server and boom.
Here is the juice shop ready for us to attack.
Now although we could dive right into attacking this host from a web app Penn Tester's perspective let's
go back and use a few of the tools and skills we learned from our past videos.
Let's drop to the command line and do an end map scan just to see if anything out of the ordinary pops
up.
Now seeing as this is my new Ubuntu Linux server I would expect to see the S-sh port open and it looks
like the only thing open besides that is the shop port at 3000.
OK so why don't we then take another step and running nikto scan on the shop.
Now keep in mind Jews shop is running on this weird port of 3000 So we need to specify that in nikto.
By using the TAC p space 3000 option.
Interestingly nikto found in FCP folder a public folder and a log file that may leak application and
system details and just for fun let's see if Derbe finds anything else.
The concept that nikto and Derb have found definitely warrant investigation.
But before we do that you may have noticed in the background here that the juice shop popped up a little
box saying we solved a challenge that we got the juice shop to provoke an error that is not very gracefully
handled.
So what's this message about well if you read some of the incredibly extensive documentation that you
shop creators have made online you will learn that the juice shop has a built in scoring system so that
you can not only know what vulnerabilities to go after within the site but when you've successfully
exploited them.
Now spoiler alert.
I'm going to show you one way to find the hidden scoreboard.
You could simply try guessing variations of it from the address bar here but it doesn't look like I'm
having much luck.
Or we could take a look at the source code and I'm just going to look for anything with the word score
in it.
And I will flip to the results until I find what looks like a u r l path and I see that right there.
We might have a winner.
So let's copy and paste this and see if we hit the jackpot which we did.
Now what we have here is a huge list of challenges ranked by difficulty and again to the awesome part
is that when you complete a challenge you shop will let you know immediately by popping up a green box
in its interface.
Let's do another example here with a one star challenge.
Shop wants us to execute a dumb Exocets attack using this payload.
I'm going to copy it and then one obvious place to try it might be this search box at the top of the
page and boom we popped the excesses box and now look do shop lets us know that this challenge is complete.
So we go back to the scoreboard we can see that the challenge is now marked as solved.
But let's get back to using burp suite for a more focused attack and to do that I want to go after this
specific challenge here where we are to give zero star feedback to the store.
Now before we go hunting for that vulnerability let me flip over to burp and one of the things I want
to do is filter down my scope a bit so that I'm only seeing traffic flowing to and from the Jew shop.
One way to do that is to find the folder for the Jew shop in the site map and in my case it's this one
and I will right click it and say add to scope empurpled then ask if you essentially want to stop logging
requests that are not in the shop scope.
I'll say yes to this and then I'm also going to click this gray filter box and I'm going to choose to
show only in the scope items and then under MIME type I'm going to take everything so that I see all
the content while we're here.
Let's also look under the proxy tab and then the HTP history tab.
This is a log of every request that's come in and out of burp as you can see it's a lot of information.
So I'm going to click up here in this gray filter bar.
And again I'm going to tell Bert to only show me content that's in scope.
And as far as mime type again I'm just going to tick all the boxes so I see everything OK.
So we're looking pretty clean and mean now let's head back over to the juice shop and see where we might
go in order to leave zero star feedback for the store.
It looks like here in the upper right of the shop we can contact the shop owners and I think this is
what they're talking about.
It looks like we can leave a comment and then a one to five star rating but not a zero.
OK so first let's just leave a one star rating with some comment and submit it.
And now let's flip over to a burp and see what that looks like in the HTP history tab.
From the post request we can see our one star rating as well as our comment.
Now the goal is for us to send a zero star rating but how can we do that if the web gooey doesn't allow
us to well.
There are several ways but the way I want to show you is by using the burp intercept.
Remember how we talked about how it can act like a bouncer and sort of stop people at the virtual door
if you will ok.
I'm going to go into proxy and then intercept and click intercept is off so that it gets turned on.
That I'm going to go back to the Jew shop and try to submit feedback one more time.
What I'm hoping we can do is make intercept stop this request before it hits the juice shop and then
we'll have the ability to tamper with it.
OK so let's flip back to burp again and we can see here that intercept has grabbed this request before
it was sent on to the juice shop and we can simply click right into this post request edit it and send
it on its way.
So here where the rating says three.
I'm just going to replace that with a zero then I'll click forward to send the request along to do shop.
And finally I'll click intercept is on to turn it off so that all traffic simply flows like normal again.
And now look at that.
We've successfully given zero star feedback to the shop owners.
And if we head back to our scoreboard we'll see we are making great progress on the one star challenges.
Now we this video we only scratched a tiny bit of this surface when it comes to using burp and attacking
the juice shop.
But my hope is that this gets you excited to set up your own in-house juice shop and start banging away
at it.
It's a fantastic way to sharpen your way about pen testing skills for free from the comfort of your
own home and without any complicated cloud infrastructure to set up.
By the way if you get stuck the juice shop will give you a small hint by hovering over the unsolved
button for any challenge.
And if you're still stuck you can click the box for more help.
But I highly recommend you try this and use hints only when you've given it the old college try as it
is an awesome feeling when you finally start unlocking some of the upper level challenges.