This chapter provides the setup instructions necessary to proceed through the material in this book. Starting with downloading Burp, the details include the two main Burp editions available and their distinguishing characteristics.

To use the Burp suite, a penetration tester requires a target application. This chapter includes instructions on downloading and installing OWASP applications contained within a virtual machine (VM). Such applications will be used throughout the book as targeted vulnerable web applications.

Also included in this chapter is configuring a web browser to use the Burp Proxy Listener. This listener is required to capture HTTP traffic between the Burp and the target web application. Default settings for the listener include an Internet Protocol (IP) address, 127.0.0.1, and port number 8080.

Finally, this chapter concludes with the options for starting Burp. This includes how to start Burp at the command line, also with an optional headless mode, and using the executable.

The first step in learning the techniques contained within this book is to download the Burp suite. The download page is available here (https://portswigger.net/burp/). You will need to decide which edition of the Burp suite you would like to download from the following:

• Professional
• Community
• Enterprise (not covered)

What is now termed Community was once labeled Free Edition. You may see both referenced on the internet, but they are one and the same. At the time of this writing, the Professional edition costs $399.

To help you make your decision, let's compare the two. The Community version offers many of the functions used in this book, but not all. For example, Community does not include any scanning functionality. In addition, the Community version contains some forced throttling of threads when using the Intruder functionality. There are no built-in payloads in the Community version, though you can load your own custom ones. And, finally, several Burp extensions that require Professional will, obviously, not work in the Community edition.

The Professional version has all functionality enabled including passive and active scanners. There is no forced throttled. PortSwigger (that is, the name of the company that writes and maintains the Burp suite) provides several built-in payloads for fuzzing and brute-forcing. Burp extensions using scanner-related API calls are workable in the Professional version as well.

In this book, we will be using the Professional version, which means much of the functionality is available in the Community edition. However, when a feature is used in this book specific to the Professional edition, a special icon will indicate this. The icon used is the following:

To begin our adventure together, go to https://portswigger.net/burp and download the edition of the Burp suite you wish to use. The page provides a slider, as following, which highlights the features of Professional and Community, allowing you to compare them:

Many readers may choose the Community edition to gain familiarity with the product prior to purchasing.

Should you choose to purchase or trial the Professional edition, you will need to complete forms or payments and subsequent email confirmations will be sent to you. Once your account is created, you may login and perform the download from the links provided in our account.

To complete this recipe, you will need the following:

• Oracle Java (https://www.java.com/en/download/)
• Burp Proxy Community or Professional (https://portswigger.net/burp/)
• Firefox Browser (https://www.mozilla.org/en-US/firefox/new/)

After deciding on the edition you need, you have two installation options, including an executable or a plain JAR file. The executable is only available in Windows and is offered in both 32-bit or 64-bit. The plain JAR file is available for Windows, macOS, and Linux.

The Windows executable is self-contained and will create icons in your program listing. However, the plain JAR file requires your platform to have Java (https://www.java.com/en/download/) pre-installed. You may choose the current version of Java (JRE or JDK) so feel free to choose the latest version:

The Broken Web Application (BWA) is an OWASP project that provides a self-contained VM complete with a variety of applications with known vulnerabilities. The applications within this VM enable students to learn about web application security, practice and observe web attacks, and make use of penetration tools such as Burp.

To follow the recipes shown in this book, we will utilize OWASP's BWA VM. At the time of this writing, the OWASP BWA VM can be downloaded from https://sourceforge.net/projects/owaspbwa/files/.

We will download the OWASP BWA VM along with supportive tools to create our web app pentesting lab.

To complete this recipe, you will need the following:

• Oracle VirtualBox (https://www.virtualbox.org/wiki/Downloads)
  • Choose an executable specific to your platform
• Mozilla Firefox Browser (https://www.mozilla.org/en-US/firefox/new/)
• 7-Zip file archiver (https://www.7-zip.org/download.html)
• OWASP BWA VM (https://sourceforge.net/projects/owaspbwa/files/)
• Burp Proxy Community or Professional (https://portswigger.net/burp/)
• Oracle Java (https://www.java.com/en/download/)

For this recipe, you will need to download the OWASP BWA VM and install it by performing the following steps:

1. Click Download Latest Version from the OWASP BWA VM link provided earlier and unzip the file OWASP_Broken_Web_Apps_VM_1.2.7z.
2. You will be presented with a listing of several files, as follows:

3. All file extensions shown indicate the VM can be imported into Oracle VirtualBox or VMware Player/Workstation. For purposes of setting up the web application pentesting lab for this book, we will use Oracle VirtualBox.
4. Make a note of the OWASP Broken Web Apps-cl1.vmdk file. Open the VirtualBox Manager (that is, the Oracle VM VirtualBox program).
5. Within the VirtualBox Manager screen, select Machine | New from the top menu and type a name for the machine, OWASP BWA.
6. Set the type to Linux and version to Ubuntu (64-bit), and then click Next, as follows:

7. The next screen allows you to adjust the RAM or leave as suggested. Click Next.
8. On the next screen, choose Use an existing virtual hard disk file.
9. Use the folder icon on the right to select OWASP Broken Web Apps-cl1.vmdk file from the extracted list and click Create, as follows:

10. Your VM is now loaded in the VirtualBox Manager. Let's make some minor adjustments. Highlight the OWASP BWA entry and select Settings from the top menu.
11. Select the Network section in the left-hand pane and change to Host-only Adapter. Click OK.

12. Now let's start the virtual machine. Right-click then choose Start | Normal Start.

13. Wait until the Linux system is fully booted, which may take a few minutes. After the booting process is complete, you should see the following screen. However, the IP address shown will be different for your machine:

14. The information presented on this screen identifies the URL where you can access vulnerable web applications running on the VM. For example, in the previous screenshot, the URL is http://192.168.56.101/. You are given a prompt for administering the VM, but it is not necessary to log in at this time.
15. Open the Firefox browser on your host system, not in the VM. Using the Firefox Browser on your host machine, enter the URL provided (for example, http://192.168.56.101/), where the IP address is specific to your machine.

16. In your browser, you are presented with an index page containing links to vulnerable web applications. These applications will be used as targets throughout this book:

Leveraging a customized virtual machine created by OWASP, we can quickly set up a web app pentesting lab containing purposefully vulnerable applications, which we can use as legal targets for our exercises throughout this book.

For non-Windows users or those Windows users who chose the plain JAR file option, you will start Burp at a command line each time they wish to run it. As such, you will require a particular Java command to do so.

In some circumstances, such as automated scripting, you may wish to invoke Burp at the command line as a line item in your shell script. Additionally, you may wish to run Burp without a graphical user interface (GUI), referred to as headless mode. This section describes how to perform these tasks.

We will review the commands and actions required to start the Burp Suite product:

1. Start Burp in Windows, after running the installer from the downloaded .exe file, by double-clicking the icon on desktop or select it from the programs listing:

When using the plain JAR file, the executable java is followed by the option of –jar, followed by the name of the download JAR file.

2. Start Burp at the command line (minimal) with the plain JAR file (Java must be installed first):

If you prefer more control over the heap size settings (that is, the amount of memory allocated for the program) you may modify the java command.

3. The java executable is followed by the –jar, followed by the memory allocation. In this case, 2 GB (that is, 2g) is allocated for read access memory (RAM), followed by the name of the JAR file. If you get an error to the effect that you cannot allocate that much memory, just drop the amount down to something like 1,024 MB (that is, 1024m) instead.
4. Start Burp at command line (optimize) with the plain JAR file (Java must be installed first):

5. It is possible to start Burp at the command line and to run it in headless mode. Headless mode means running Burp without the GUI.

For the purposes of this book, we will not be running Burp in headless mode, since we are learning through the GUI. However, you may require this information in the future, which is why it is presented here.

6. Start Burp at the command line to run in headless mode with the plain JAR file (Java must be installed first):

Note the placement of the parameter -Djava.awt.headless=true immediately following the -jar option and before the name of the JAR file.

7. If successful, you should see the following:

Press Ctrl + C or Ctrl + Z to stop the process.

8. It is possible to provide a configuration file to the headless mode command for customizing the port number and IP address where the proxy listener is located.

9. In each startup scenario described, you should be presented with a splash screen. The splash screen label will match whichever edition you decided to download, either Professional or Community.
10. You may be prompted to update the version; feel free to do this, if you like. New features are constantly added into Burp to help you find vulnerabilities, so upgrading the application is a good idea. Choose Update Now, if applicable.
11. Next, you are presented with a dialog box asking about project files and configurations:

12. If you are using the Community edition, you will only be able to create a temporary project. If you are using the Professional edition, create a new project on disk, saving it in an appropriate location for you to find. Click Next.

13. The subsequent splash screen asks you about the configurations you would like to use. At this point, we don't have any yet, so choose Use Burp defaults. As you progress through this book, you may wish to save configuration settings and load them from this splash screen in the future, as follows:

14. Finally, we are ready to click Start Burp.

Using either the plain JAR file or the Windows executable, you can launch Burp to start the Proxy listener to capture HTTP traffic. Burp offers temporary or permanent Project files to save activities performed in the suite.

Burp is described as an intercepting proxy. This means Burp sits between the user's web browser and the application's web server and intercepts or captures all of the traffic flowing between them. This type of behavior is commonly referred to as a Proxy service.

Penetration testers use intercepting proxies to capture traffic flowing between a web browser and a web application for the purposes of analysis and manipulation. For example, a tester can pause any HTTP request, thus allowing parameter tampering prior to sending the request to the web server.

Intercepting proxies, such as Burp, allow testers to intercept both HTTP requests and HTTP responses. This allows a tester to observe the behavior of the web application under different conditions. And, as we shall see, sometimes, the behaviors are unintended from what the original developer expected.

To see the Burp suite in action, we need to configure our Firefox browser's Network Settings to point to our running instance of Burp. This enables Burp to capture all HTTP traffic that is flowing between your browser and the target web application.

We will configure Firefox browser to allow Burp to listen to all HTTP traffic flowing between the browser and the OWASP BWA VM. This will allow the proxy service within Burp to capture traffic for testing purposes.

Instructions are available on PortSwigger at (https://support.portswigger.net/customer/portal/articles/1783066-configuring-firefox-to-work-with-burp) and we will also step through the process in the following recipe.

The following are the steps you can go through to listen to all HTTP traffic using Burp:

1. Open the Firefox browser and go to Options.
2. In the General tab, scroll down to the Network Proxy section and then click Settings.
3. In the Connection Settings, select Manual proxy configuration and type in the IP address of 127.0.0.1 with port 8080. Select the Use this proxy server for all protocols checkbox:

4. Make sure the No proxy for the textbox is blank, as shown in the following screenshot, and then click OK:

5. With the OWASP BWA VM running in the background and using Firefox to browse to the URL specific to your machine (that is, the IP address shown on the Linux VM in VirtualBox), click the reload button (the arrow in a circle) to see the traffic captured in Burp.

6. If you don't happen to see any traffic, check whether Proxy Intercept is holding up the request. If the button labeled Intercept is on is depressed, as shown in the following screenshot, then click the button again to disable the interception. After doing so, the traffic should flow freely into Burp, as follows:

In the following, Proxy | Intercept button is disabled:

7. If everything is working properly, you will see traffic on your Target | Site map tab similar to what is shown in the following screenshot. Your IP address will be different, of course, and you may have more items shown within your Site map. Congratulations! You now have Burp listening to all of your browser traffic!

The Burp Proxy service is listening on 127.0.0.1 port 8080. Either of these settings can be changed to listen on an alternative IP address or port number. However, for the purpose of learning, we will use the default settings.