Welcome to part one of this module
in this collection of modules.
We're going to be studying the usage of burps sweet in order to make this presentation a bit easier.
I have decided to divide the videos covering this tool across several modules as it is very complex.
Burp sweet also known in some penetration testing circles simply as burp is a graphical tool for testing
web application security.
The tool is written in Java and was developed by Port swinger security.
The tool has two different versions.
A free version that comes prepackaged with Kali 2.0 as well as many older versions of Kali I believe
going all the way back to backtrack five and there is also a full version available which can be purchased
after a trial period which is called the Professional Edition the free version has significantly reduced
functionality although once a student learns the free version that should not be overly difficult transition
to the professional burp suite was developed to provide a comprehensive solution for web application
security checks.
In addition to basic functionality such as proxy server scanner and intruder The tool also contains
more advanced options such as Spider a repeater a decoder compare an extender and a sequencer.
I will elaborate more on these as we go along.
The company behind burps sweet has even developed a mobile application containing similar tools which
is compatible with IOW 8 and above
before we begin with burp sweet.
However it will be necessary to set up a target server as a demonstration of what this tool is capable
of the best exploitable machine used in prior modules can be utilized because it comes with -- vulnerable
Web application already installed on it if you wish to follow along this tutorial then I strongly recommend
you set up a metal splitter BL machine of your own to conduct your tests on so as to stay 100 percent
legal.
Alternatively you could download and setup down vulnerable Web application as a standalone target if
you wish.
I personally feel that met a split level virtual mesh virtual machine is just easier to setup all around
but it is your option and other such vulnerability testing programs could be used.
For example you might set up Web go to test burp suite with.
Ultimately it is up to you if you need instructions on how to set up a meet a split table virtual machine.
Please go back to the first module and see the appropriate video okay.
I do have a few more things to cover before I begin but let's go ahead and load up burp sweet.
As always this can be done from the terminal window or by going to applications web applications.
Web application analysis and then clicking burp sweet I should note that burp sweet can be used with
a lot of operating systems because it runs in Java so you could easily download it and get it up and
running very quickly even in a Windows environment.
For right now though I recommend sticking to Cali but that's only to keep things as straightforward
as possible when you first load burps sweet it'll ask you to update.
I'm not going to do this right now.
You can do it if you wish.
Before we begin I do have to say that the topic of a web application security is pretty much a class
unto itself.
The goal of this presentation is to familiar familiarize you with burp suite itself and give you a foundational
knowledge upon which to build.
It won't be within the scope of this class to cover every possible use and every possible method of
attacking web based security burp suite is essentially an integrated platform for performing security
testing of Web applications.
The first thing you need to understand is that it will allow us to intercept the data being sent between
our browser and the web application that we're trying to test.
So it's a great way to understand how data is being transferred as well as how data can be manipulated
between the client and the web application itself.
This video will be covering the community version as has been said.
Certain options will therefore not be available to begin with.
We're going to need to setup and configure our web browser of choice.
If you're using Cally I'm going to assume that you are using Firefox.
So go ahead and launch Firefox.
Now to save time I've already done this.
Once open.
Go ahead and click on the options menu on the far right and select preferences
for here click on the advanced category on the left.
Select network
and under connection click settings
and once on this screen we want to select manual proxy configuration and make sure it is set to the
local host.
In this case and most probably yours as well it's going to be 1 27 0 0 dot 1 and set the port to 8 80.
Make sure this is done for SSL f T.P. and socks as well.
You also need to make sure that the use this proxy server for all protocols box is checked once this
is done click OK and now we'll head over to burp sweet
by default.
The community version only allows you to use a temporary project if you have the professional version
and allows you to save your project.
So we'll hit next and we're going to use the burps sweet defaults so we'll click Start burp.
This is going to take a few minutes to start up.
I'll explain the interface generally but we'll be diving more into how brb actually works in the next
video for this introduction.
I just want to get you setup with the tool so that you understand what exactly is going on.
Welcome to brb right away.
This can seem kind of intimidating because we have a lot of tabs and not much on screen explanation.
I mentioned at the start of this tutorial that I'd be covering what these different functionalities
do and we'll be covering them one by one as we go.
So by default you have your target proxy spider scanner intruder repeater sequencer decoder compare
extender your project options your user options and your alerts.
And like I said we'll be going through all of this as we perform our real world testing on our vulnerable
Metis Floyd ABL machine by default to start out you want to go in to the proxy tab and from here let's
go ahead and click our options
and you want to make sure that your proxy listener is set as it is displayed here.
127 dot 0 0 dot 1 port eight thousand and there should be a checkmark in the box under running.
This is the same address that we just set in firefox.
You can also create your own with the add button edit or remove it.
Here you get the idea.
Now we'll go back to our browser
and this is where the real magic happens so if we type in a simple test site such as for example about
a bad example dot com then we come back over to burp sweet and click the H TTP history tab we can see
that by default.
There are some Firefox portals and some get methods displayed here
if you don't see this or if example dot com did not come up.
Be sure to click on The Intercept tab and press the forward button also make sure that intercept is
turned on.
So if we click on the result one of them anyway
we can see the information below.
We can see the information displayed below for that result.
You can see in raw and headers and hex.
More about the request that was sent to the web application.
It shows the user agent
which was Mozilla the target which was example dot com the accept language which was English the encoding
the connection et cetera.
If we pull up headers we can see that the headers show very clearly the get host user agent et cetera
et cetera et cetera.
You may be a little confused if this is your first time hearing about headers and requests and response
pairs.
But don't worry that will be something that we get into as we go along.
So bouncing back to the browser
will head over to the Met A splitsville Web site which is just the IP address in this case 10 dot 0
0 dot 8 and just a reminder make sure that intercept is turned on you see here forward is no longer
great out.
We're going to need to forward this request for Metis Floyd able to actually come up so we click forward
and now if we go back to the browser hopefully it will come up and there we go so popping back over
to our perp suite window
we can see those requests
and of course being that it's met exploited all we can see that an upgrade in secure requests is displayed
here as well
as well as other potentially compromising data because again met a split level.
All right.
So as you can see that is how you intercept data that is being sent from the client to the web application
and how you can analyze the data being sent and ultimately manipulate it with all that being said all
this was just a very basic look and hasn't really covered anything in terms of actual web based penetration
testing yet.
However that is coming up soon.
The goal here was just to get you started.
This is a very complex tool and we will be looking at it more closely in the next few videos in this
module that's going to be it for this video though.
Just a quick introduction to burp sweet and how to get it set up to intercept your first data requests
in the next video we'll be getting started with the methodologies and terminologies and understanding
the ins and outs of each TTP.
Hopefully a lot better.
Thank you.