Now let's talk about brb sweet since we have everything set up we've already installed burp sweet in
an earlier video and we got the certificate set up.
We talked about what it's capable of and we did a basic intercept and kind of just looked at the responses
that we were getting and we we saw that we could do a little bit of a numerator through it.
But for this entirety pretty much of all of these exploits we're going to be using brb sweet in one
way or another and it's gonna be really flexible and you're gonna see what it's capable of doing.
Now I am going to be using the Community Edition I will describe the differences as we talk about it
of the pro versus the community.
And in this video I just want to give you a high level overview of what we're going to be doing.
And I also want to talk briefly about what to expect when you're doing a web app pen test so typically
with web apps you have three stages of testing.
You have a UN authenticated stage so when you come in here and you are on this Web site like you're
here right and you go to account there's no account where we're not logged in were considered on authenticated.
So with that we can try to navigate around the page and turn the intercept off here and we can just
click around and see what we can find right click on certain things see what's available to us see what
we're capable of as a user we can go to log in form we could try to log in here with you know credentials
stuffing or we could just try admin admin if we see default credential kind of deal we go to forgot
your password and try to utilize it forgot your password scenario and etc..
OK.
So there's a lot of different features that we can do.
The second tier is what's called a user tier.
So we log in as a user and we don't have admitting privileges but we do have some user accessibility.
So we'll get some sort of extra access that we wouldn't have as a authenticated site.
And then lastly we're going to test the application as a admin user.
And that will give us access to admin panels and other things that users should not be able to see what
we do all this testing to see if maybe from the UN authenticated side you can access an app and panel
or maybe from a user side.
You should.
You can access an admin panel or you can just bypass certain restrictions that should be there across
these users.
So it's always good to test and see who can get to where and why.
And we want to find all those vulnerability types.
So we're we're doing this testing we.
We come in and we start on authenticated usually.
And what I like to do is again I just like to click around and kind of get a feel for what's going on.
So you know there's customer feedback there's the about us here.
I'm just clicking through photo wall.
And if you go to Target we have our local host of three thousand here.
I always like to just get the target and I like just added to the scope so I'll right click and add
the scope and then I'm going to go ahead and just click up here on the top and I'm gonna say show only
in scope items that filters out the rest that way when the proxies picking things up it's only picking
up and storing in this area.
What we need.
So if we clicked on this here you can see those starting to pick up things that even we didn't go to.
There's API back here and you can see challenges feedbacks quantities.
There's a lot of different things in here that we have access.
Look there's a rest admin and we can kind of click through some of this stuff and see if any of this
is interesting and this is what we want to do on an authenticated side and what this is doing here is
this is going through and it is pulling down information from the traffic that it sees through this
proxy and one feature that we do not have access to is the scan feature now pro addition has access
feature of scanning and of engagement tools.
So we're gonna be without those for this course.
But if I were doing a pen test I would have pro and you will have pro as well and you're going to want
to scan the site and scanning we'll do two different things.
One is going to do crawling is used to be called spider ring and this was a feature that was part of
brb suite prior to edition to point zero.
So they took that away and made it more of a paid addition type deal.
But you would do spider ring which is trying to go out to different Web sites within the branch here
and it's going to look for you know other sites and try to see where it can get access to on top of
that we have what's called active scanning now active scanning we'll go out and we have a dashboard
here and this is just a demo but it shows the you know the different issues that I might pull up and
it's going to actively scan against a Web site and it's going to try to do sequel injection or do cross-eyed
scripting attacks or do all these different attacks and see what it can pick up.
Now the thing about scanning Inge with my experience and I brand actually as you shop through a scanner
before it picks up maybe 10 percent of what's out there.
So scanning is nice but you shouldn't rely on your scanning you should rely on manual testing and going
through your checklist scanning is good at picking up some things and helping you identify certain little
flaws here and there but do not rely on your scanners don't rely on your NSA don't rely on your brb
sweet pro or any of that while they're good to have they're not fully reliable so let's talk about some
of the features of brb suite and what we can do with it.
So you've already seen the proxy feature.
We can turn the intercept on and when the intercept is on we refresh refresh your page here.
You can see that it intercepts and it just hangs this page.
And what that's doing is this is giving us the option to mess with this or at least see what's going
on here.
We could see the what the request looks like we're making a get request and we're making it to the local
host.
And we have our user agent here.
We've got some cookies and this is just a basic request.
Now I want you to right click on this request and go ahead and just send that to repeater and repeater
is a request repeater so we can go ahead and send this request and you can see what comes back.
OK.
We get a three or four not modified.
So let's go here and just for this request and see what happens.
And you can see get socket the IO comes through and there's a few little things that's going on.
This one's coming through which is timing that this is an API and we're going to keep forwarding through
and what's happening to is where we're intercepting more than just local host three thousand.
So what we want to do to is we're gonna go ahead and go into the options here.
And we're going to say we're going to intercept client requests if targets in scope and server responses
if the targets in scope.
That way we'll intercept anything from any other Web sites.
Mozilla will go in the background and have requests come through while you're sitting there on intercept
as well.
So a repeater allows you to repeat requests when we're doing this or we can do is say like we want to
do parameter tampering or we wanted to test here we say you know we've got to get we've got to get requests.
Let's go ahead and just change it to a poetry class.
Let's see how the Web site handles it.
And we can make different modifications maybe we delete a cookie here or we change the user agent or
we do something in here that is a little bit malicious after we've intercepted this request and then
we take it to repeater and we can repeat our requests over and over and over and you'll see how this
becomes useful as we go on through the course.
So other things we've already covered intruder in this course now.
Intruder again is where we can store a payload and then we can use that to use it intruder attack.
Now the intruder attack on Community Edition is very slow.
We don't have access to a lot of speed here because they limit you because they want you to buy the
pro edition.
You can go into the extender store here and if you go to the App Store if you click on AppStore sort
by popularity and there are some free ones so you see the ones where it says requires brb suite.
There are some free ones in here that we can install.
And one of those is actually the turbo intruder which would do intruder at a faster speed.
We're really not going to need it for this cause I just want to point out and this is another feature
to a brb suite versus pro is that the prohibition has all these additional scanning features like active
scan plus plus is additional on top of the active scanning that does it looks for even more vulnerabilities.
Retired James looks for vulnerabilities in javascript libraries which is really nice you know and you
go down the list and there's all these different really really nice features like CSR f looks for CSR
F on our abilities and you don't have to know what any of these are right now but it's just nice to
have those in the prohibition that we won't have now in the community edition.
So on top of this we have a compare feature in here.
We can send one item to compare and then another item and just to look at the differences if we want
to.
I don't use this too much but it's always nice to see it.
Hey.
Has something changed on this page and what change in the page or the response that we got decoder is
a nice feature as well.
So say that you have something like this.
I can highlight this cookie and we're going to send this to decoder and say something is encoded as
like base64 you are all encoding.
You can go ahead and decode this or you can encode this.
So say you want to encode this whole thing as you are all encoding well encodes the whole thing or you
want to encode the whole thing as you know base64.
Let's put this in a base sixty four and this isn't just another feature of birth suite.
That is good to use mainly what we're going to be using in this course is the proxy intercept.
We'll be hanging out a lot in the target page and we'll be looking through the targets and what comes
through when we're scanning and we're going to be in the repeater tab mostly.
So the repeater is going to allow us to intercept requests send them to repeater and modify the requests
and keep targeting different things until we get something that works for us.
So that's just the high level overview.
Again it's not going to go into full detail because we only have the community edition.
I do recommend purchasing the prohibition if you once you get into it.
So it's not a necessity right now but if you are interested in bug bounty hunting or if you want to
get the full the full effect of learning web apps I I highly recommend the prohibition but again it's
not a necessity at this time.
So from here we're going to move into our different attacks and we're going to start explaining these
attacks and we'll focus on each one of them and what we can do with them.
So the first attack up in the US top 10 are injection attacks.
So in the next video we're going to start talking about sequel injection.