‫Man: Hi.
‫Within this lecture we are going to install
‫the Burpsuite and also set it up
‫so that we can use it with our penetration tests.
‫So what I'm going to do, I'm already in my bound to,
‫actually, we are done with the bound to things
‫because we have already installed the vAPI
‫and running on the server, right?
‫So if you type your IP address on the browser
‫you can see the vAPI.
‫Now that said, you don't need to just log
‫into the server anymore.
‫After you are done, just don't forget
‫to destroy the drop it or just delete
‫the project so your credit card won't be charged, okay?
‫So, if you see this when you go to your IP/VP or vAPI,
‫then it's okay, Okay?
‫So once you're done with the WAPI test over here
‫or vAPI test over here, you can come over here and say,
‫destroy this droplet or you can just delete the project
‫from the settings as well, okay?
‫Don't forget to do that.
‫So far so good.
‫So, what are we going to do within this section?
‫Within this lecture?
‫We're going to install the Burpsuite so
‫that we can work with this vAPI
‫and interrupt and capture the packets
‫so that we can see them
‫or manipulate them in a way that we want.
‫So, if you have been watching this
‫for the web pen testing course,
‫you already know how to do that, right?
‫So if you're watching the mobile application,
‫Mobile Ethical Hacking course,
‫then you need to watch this lecture.
‫But if you're coming here from web pen testing course,
‫just skip this lecture.
‫So if you Google Burpsuite, you will see
‫that this is a tool that has been produced
‫by the Ports Swigger Company, portswigger.net
‫so the website is actually portswigger.net/burp.
‫And Burpsuite is kind of a proxy
‫so we can see the requests that we are sending
‫and analyze the responses that we are getting
‫and we can interrupt them
‫and we can actually manipulate them
‫before we send to the server as well.
‫So, this works like a proxy because it captures the traffic
‫and we send this through the Burpsuite.
‫It's a very cool tool.
‫Of course, this is going to be like a crash course
‫for the mobile Ethical Hacking Course users.
‫But, for the Web pen testing side,
‫we have already seen this a lot.
‫So, this is another free tool,
‫but there is a free version, of course,
‫we are going to use it.
‫The free version is called Community Version.
‫So if you come over here to products,
‫you can see the community addition over here.
‫Of course, you,
‫if you want, you can purchase the enterprise
‫or the professional versions as well
‫but it's a little bit expensive, like 300,
‫400 bucks.
‫So I'm just going to go with the community edition
‫and we are going to talk
‫about the differences between the community edition
‫and also the professional edition as well.
‫Don't worry about it, but all you gotta do
‫is just download this and, if you download this,
‫you can just install it by clicking on next, next,
‫next on Windows and on Mac as well.
‫So if you're using Key Color Linux, it's already,
‫it should be already installed on Color Linux
‫or any Linux distribution.
‫You can just download it and install it as well.
‫So, once you create a project in the Burpsuite,
‫you can just use the defaults, okay?
‫You don't need to change anything
‫and you will see a screen like this.
‫So, what are we going to do with the screen?
‫Burpsuite has a lot of modules, okay?
‫We can do so many things with Burpsuite.
‫It's a very good tool.
‫It's the tool for the web pen testing.
‫We can intercept the packets using
‫the proxy module over here, I'm gonna show you how.
‫All you gotta do is just give some settings to proxy
‫and make sure the browser has the same settings as well.
‫Using the intruder module,
‫you can actually do some brute force attacks
‫and we're gonna do a lot of those in the section as well.
‫So we gonna see how to use it.
‫In the repeater, we can,
‫you can send some responses, send some requests,
‫and analyze the responses.
‫You can manipulate the request and see how the API
‫or the server reacts back.
‫So you can try and try and try changing the parameters
‫or changing the headers in this request.
‫It's very good.
‫For example, there's a decoder over here.
‫You can decode or encode anything that you want.
‫Like you can just write something and encode this as
‫like base 65 or I don't know, HTML,
‫or any kind of encryption.
‫It's a very good tool actually, and we're gonna use a lot
‫of modules from here, don't worry about it.
‫All you gotta worry right now is to set it up
‫and create a project.
‫Once you do it, you can go to the options under
‫the proxy module because you are going to have
‫to change something over here.
‫If you don't see this 127.0.01.8080,
‫you can click on add and add this number over here.
‫So Port should be 8080, okay?
‫8080.
‫And the host should be 127.0.01.
‫Okay, so this is your local host with Port 8080.
‫Why are we doing this?
‫Because we are going to give the exact same number,
‫exact same proxy numbers, to the browser as well.
‫And all the other settings, as you you can see down here,
‫should be just left alone, okay?
‫And I'm going to turn on
‫and turn off the intercept regularly while we're using this
‫and I'm going to show you why.
‫So, if you go to your browser right now.
‫I'm using the Brave Browser but you can use Google Chrome,
‫you can use Safari, you can use Fire Folks,
‫anything you want.
‫Brave is very cool so that's why I'm using it.
‫Turn the intercept off for a minute and go to google.com.
‫But because you need to download something
‫called FoxyProxy, I believe this doesn't work in Safari
‫but it works in Brave Chrome and Fire Folks as well.
‫FoxyProxy is kind of an extension, okay?
‫You can add it to Google Chrome,
‫you can add it to Fire folks, Brave.
‫All you gotta do is just search for it
‫and find the extension website.
‫So this is what I'm looking for, FoxyProxy Standard.
‫As you can see, many users use it.
‫So this is a very easy tool to change your proxy settings
‫for the related browser.
‫You will see some install button over here.
‫I'm seeing remove button because I'm already using
‫it inside of my terminal, inside of my browser.
‫Here you go, I can see the FoxyProxy here.
‫Once you install the FoxyProxy, you should open the options.
‫In the options, you should give the exact same numbers
‫that you have given to the Burpsuite.
‫So I'm going to say 127.0.01 and, for the port,
‫I'm just gonna say 8080, that's it.
‫Of course you can change the port
‫but it doesn't make sense.
‫We are working with the web.
‫You are intercepting the web requests and stuff.
‫So go with the Port 8080.
‫So you can give it a default name, you can delete it,
‫you can edit it, you can add any kind of proxy you want.
‫And after that, you can just use that proxy like this.
‫So, if you use this proxy,
‫if you use this 127.0.01 proxy over here with the Port 8080,
‫and if you use the same proxy inside of the Burpsuite,
‫as well, you can turn the intercept on like this.
‫And right now, all your traffic will be directed through
‫the Burpsuite so that you can capture the packets.
‫It's very easy.
‫Right now, let me show you what I mean.
‫I'm just gonna open a new tab,
‫or you can just go with this one, actually.
‫You can click on something, okay.
‫You can click on something like this, accessibility
‫and as you can see, it stops.
‫It doesn't go anywhere because
‫it has been captured in the Burpsuite.
‫Unless I forward this, it won't be delivered to the server.
‫Or unless I turn the interception off,
‫it won't be delivered to the server.
‫Right now, I have this request packet.
‫I can see this is a post request.
‫I can see the endpoint that is directed to
‫and I can see the cookie, I can see the headers,
‫I can see the parameters, I can see everything.
‫I can change it, or I can just turn the interception off
‫and it will just forward it to the server
‫and I can get the result back.
‫Now, I will disable this proxies
‫because I wanna show you something.
‫Maybe if you did it, and if you didn't capture the packet,
‫maybe you will need to install some kind of certificate.
‫Okay?
‫So if you come across in a situation like this,
‫if your Burp doesn't work for some reason,
‫you should google this.
‫Install Burp certificate, okay?
‫And of course, it will lead you to the portswigger.net
‫one more time because, this is the company
‫that has been developing the Burpsuite.
‫It actually has a very good documentation.
‫You can just see how to install it inside of Chrome,
‫inside of Firefox, inside of Safari,
‫and even Explorer as well.
‫So if you come over here, so if you're using Brave,
‫just go for the Chrome, okay?
‫You can see the exact same steps for the Chrome
‫and it actually has different steps
‫for the Windows and Mac, and also for the Linux as well.
‫So I'm going to show you my steps in order to do that
‫but it's very easy to accomplish.
‫All you need to do is just follow along these steps, okay?
‫Just watch these steps and it will work.
‫It's very easy to install.
‫We're going to download some certificate
‫and we are going to install it on our browser
‫or on our system, and then it will trust the Burpsuite.
‫Otherwise, maybe you are not able
‫to connect to the HTPS site.
‫So if you're using Linux, again,
‫you can just see the documentation over here
‫to install this on your machine.
‫It's not very hard, I'm going to show you how to do it.
‫Don't worry about it.
‫But if you're Windows and Linux,
‫the steps might be a little bit different.
‫So I'm going to open the Burpsuite over here, okay?
‫And I'm going to run Burpsuite,
‫but I'm going to run Burpsuite like this,
‫http://burpsuite, okay?
‫Not burpsuite.com, but Burpsuite.
‫Now, Burpsuite is running and I have changed my proxy,
‫that's why I'm seeing this, okay?
‫If you don't run the Burpsuite
‫and if you don't change your proxy
‫you won't be able to get the certificate.
‫As you can see, I can see the CA certificate
‫at the right hand side of this http://burpsuite.
‫Download this on your desktop or whatever folder you want.
‫And that's it.
‫After downloading the certificate,
‫the steps are a little bit different
‫for Mac and Windows and Linux.
‫In Mac and Windows,
‫you have to just double click on the certificate
‫and it will let you install it on your system.
‫But in Linux, as you can see,
‫you can go to the settings of the Chrome or settings
‫of the Brave so that you can find the certificate
‫and install it directly into the browser.
‫You can see all the images, you can see all the steps
‫that you need to do in order to install this certificate.
‫But downloading the certificate is same for everyone.
‫So, if you come over here,
‫and if you go to the settings
‫like this in the Brave settings, for example.
‫I'm going to search for a certificate
‫but I'm in a Mac, remember that.
‫As you can see, it finds some certificates,
‫like under the security, I believe, okay?
‫And, if I come down here to the advanced site,
‫I believe I can see the main certificates, okay?
‫But once I click on that,
‫it actually opens the key chain access.
‫So key Chain Access is the tool that we use
‫in the Mac operating system
‫in order to store the certificates and stuff.
‫So what I need to do, I need to double click on it
‫and it will just add this
‫to the key chain directly, automatically.
‫But if you are not using Mac,
‫or if you're not, if you're using Windows or Linux,
‫then steps would be very similar.
‫You can see the documentation yourself,
‫but you will download the certificate
‫in the exact same way that we have done.
‫After that, for example,
‫let me go to the Windows for the Internet Explorer.
‫As you can see, it says that you have
‫to run this as an administrator, okay.
‫That is a a little bit different.
‫You gotta right click and choose run as administrator
‫and you can just say install certificate, okay?
‫You have to visit http://burpsuite in all operating systems
‫in order to download this certificate.
‫And after installing the certificate,
‫if you haven't been able to capture the packet
‫that we have seen, now you will be able to,
‫okay?
‫Or you will be able to use the Burpsuite
‫like in appropriate way right now.
‫So make sure to install the certificate
‫if you experience any kind of weirdness once you go
‫to Burpsuite, once you open the Burpsuite project
‫and then try again.
‫So, don't forget that,
‫if you're using Burp, then you should also
‫use proxy settings, okay?
‫Or otherwise you won't be able to browse the internet.
‫So I'm gonna search my name and as you can see,
‫I get the packet, I get the packet.
‫If I forward this, if I forward this,
‫it will be sent to the server,
‫it'll be sent to the Google servers.
‫But if I don't forward the packets
‫that will just get stuck on the main Google page.
‫Here you go.
‫Now, as you can see,
‫we see all the details regarding me inside of Google
‫and we are still capturing the packets,
‫because Google's making some requests
‫to their APIs and maybe their other services.
‫I dunno, many things,
‫but we can see all the traffic
‫and we can even capture the traffic
‫and manipulate it in a way that we want.
‫That is how we set the Ports Swigger Burpsuite up.
‫Of course, if you already have that running
‫and working as properly in a way that you want,
‫then I believe you already skip this lecture.
‫But if not, it's a new great tool
‫that you will learn during this section.
‫So, we're gonna stop here
‫and continue with the Postman installation.