We're going to mess around with a tool called Burp Suite.
Now, Burp Suite, for sizea purposes is limited to web application scanning.
Now burp burp suite entire can do penetration testing.
I've used it before for SQL injections.
I've used it for a lot of different aspects, especially on the free version.
But however, and I preface this by saying that Cisa only identifies it for web application scanning,
which is a little bit weird that they have this tool in here.
And the reason I say that is because usually CompTIA for their certifications is very much like we want
free versions tools.
We don't want anything that costs money, but the web application portion or the web application scanner
portion of Burp Suite is actually locked behind a paywall.
So I'm not really sure what CompTIA was thinking when they threw this in here, but that's okay.
We're going to go very high level overview of it.
Just realize that we're not going to show the paid version because I don't want to show you something
that you don't really have access to without actually paying for it.
And I don't think CompTIA is going to provide us with anything that you really wouldn't be able to understand
based off the other tools.
So let's get right into it.
We're going to open up our terminal.
Let me blow this up for you.
And there's literally three ways to access this tool.
I think I've only been showing you the one way.
So today we're going to actually go through all three ways.
I could type in Burpsuite just like that.
And by providing that blue over there, I can start it up just like that.
That's one way.
The second way is I can open up a little Kali Linux icon right there, and I can go down to web applications
analysis.
And there it is right there.
The third way is I can go to the search menu and just type in burp.
And there it is.
So we're going to open this sucker up.
Obviously I'm using the community edition.
I'm going to press next for temporary.
And I'm going to use Burp Suite defaults.
And we're going to get the sucker started up.
Now the very first screen that you should see looks something like this.
And it says Getting Started with Burp Suite.
You can go through Burp Suite and it provides a quick tutorial of how to use Burp Suite.
You can also do guided tours provides you all the in-depth walkthrough of everything I won't I don't
want to say in-depth, but it will provide you a walkthrough of the tool.
You could do video tutorials over specific features of the tool, but again, many of them are stuck
behind a paywall.
You could do a Web Security Academy, which goes into finding out more about vulnerabilities using Burp
Suite.
You could do the support center or you can use Twitter under the dashboard.
This is normally where you would go through and actually do a new web vulnerability scan.
But you can see here that it's grayed out because it's locked behind a paywall.
So we really don't have that feature.
But again, it's it's pretty much a web application scanner.
You're really not going to get much more out of it than you would with any of the other web application
scanners that we've shown you, i.e. Nikto or zap.
I really like zap.
Um, and I don't think Burp Suite.
It does a good job, but I prefer zap, honestly, so I'm not really upset about it being locked behind
a paywall.
Some people would argue and they say burpsuite is better.
Yeah.
Flavors for different folks, I guess.
Uh, under your target icon you can get a sitemap, you can identify the targets.
You can go through that process for the epoxy.
You can turn the intercept on and off.
And again this is much more utilized in web application penetration testing than it is anything else
we can do.
The intruder which provides us automated tasks if we want to go through that repeater which modifies
and resends individual requests so we can repeat commands, the collaborator sounds just like it is
the sequencer which provides requests and other tools to configure live captures.
We could do a decoder.
Sounds like exactly what it does.
We could do a compare again, exactly like it sounds.
Uh, logger again, exactly like it sounds.
And then finally the organizer.
Uh, I forgot extensions.
So you can actually add extensions into Burp Suite that third parties have utilized uh, throughout
that.
Now, Burp Suite is pretty extensive tool.
And I could spend an entire day going through everything that Burpsuite has to offer.
But the good news is, as far as Cisa exam is concerned, we only are concerned with that live scan
or excuse me, that that web application scan.
And I feel like if you see Burpsuite scan on there, you'll be able to identify it pretty quickly.
Again, it's not available in the free version.
So you can't really go through this, um, through the community edition if you really want to, you
could pay for the paid version.
I don't suggest it as a brand new cyber security person, or even an intermediate.
If you're going to get into penetration testing, then I would suggest, yeah, Burpsuite is a great
tool for Pentesting, but for web application scanning for a defensive tool, it's not anywhere close
to my top ten.
For Pentesting, it definitely is, but not for defensive.
And that's what Cisa really concentrates on.
So the high level overview of Burpsuite, we really didn't do much with the tool, but I hope you learned
something from it.
And again, if you want more details just go to that learn and you can find all kinds of valuable information
right here.
All right.
That's it for today.
We'll see you next time.