The first step in learning the techniques contained within this book is to download the Burp Suite application. The download page is available here: https://portswigger.net/burp/. You will need to decide which edition of Burp Suite you would like to download from the following:

• Professional
• Community
• Enterprise (not covered): This product is designed for large companies to run Burp Scanner across thousands of targets
• Dastardly (not covered): This edition only provides Burp Scanner capabilities and is specifically designed to integrate with Jenkins and other CI tools as jobs within a DevOps pipeline

What is now termed Community was once labeled Free Edition. You may see both referenced on the internet, but they are the same. At the time of writing, the Professional edition costs $449.

To help you make your decision, let’s compare the two. The Community version offers many of the functions used in this book, but not all. For example, the Community version does not include any scanning functionality. In addition, the Community version contains some forced throttling of threads when using the Burp Suite Intruder functionality. There are no built-in payloads in the Community version, though you can load custom ones. And, finally, several Burp Suite extensions that require the Professional edition will, obviously, not work in the Community edition.

The Professional version has all the functionality enabled, including passive and active scanners. There is no forced throttling. PortSwigger (that is, the name of the company that writes and maintains Burp Suite) provides several built-in payloads for fuzzing and brute-forcing. Burp Suite extensions that use scanner-related API calls work in the Professional version as well.

In this book, we will be using the Professional version, which provides access to an extensive array of functionality compared to the Community edition. However, when a feature is used in this book that’s specific to the Professional edition, a special icon will indicate this:

Figure 1.1 – Burp Suite Professional icon

Getting ready

To begin our adventure together, go to https://portswigger.net/burp and download the edition of Burp Suite you wish to use. The page provides a slider, as shown here, which highlights the features of Professional and Community, allowing you to compare them:

Figure 1.2 – Burp Suite Professional versus Community features

You may wish to choose the Community edition to gain familiarity with the product before purchasing the Professional version.

Should you choose to purchase or use the trial version of the Professional edition, you will need to complete forms or payments and subsequent email confirmations will be sent to you. Once your account is created, you may log in and perform the download from the links provided in our account.

Software tool requirements

To complete this recipe, you will need the following:

• Oracle Java (https://www.oracle.com/java/technologies/downloads/)
• Burp Proxy Community or Professional (https://portswigger.net/burp/)
• Mozilla Firefox browser (https://www.mozilla.org/en-US/firefox/new/)

How to do it...

After deciding on the edition you need, you have two installation options, including an executable or a plain JAR file. The executable is only available in Windows and is offered in both 32-bit and 64-bit versions. The plain JAR file is available for Windows, macOS, and Linux. You can find all the available download options here: https://portswigger.net/burp/releases/professional-community-2023-4-5?requestededition=community&requestedplatform=.

The Windows executable is self-contained and will create icons in your program listing. However, the plain JAR file requires your platform to have Java (https://www.oracle.com/java/technologies/downloads/) pre-installed. You may choose the current version of Java (JRE or JDK), so feel free to choose the latest version:

Figure 1.3 – PortSwigger’s Downloads page

The Broken Web Application (BWA) is an OWASP project that provides a self-contained VM complete with a variety of applications with known vulnerabilities. The applications within this VM enable students to learn about web application security, practice and observe web attacks, and make use of penetration tools such as Burp Suite.

To follow the recipes shown in this book, we will utilize OWASP’s BWA VM. At the time of writing this book, the OWASP BWA VM can be downloaded from https://sourceforge.net/projects/owaspbwa/files/.

Getting ready

We will download the OWASP BWA VM along with supportive tools to create our web app pentesting lab.

Software tool requirements

To complete this recipe, you will need the following:

• Oracle VirtualBox (https://www.virtualbox.org/wiki/Downloads): Choose an executable specific to your platform
• Mozilla Firefox browser (https://www.mozilla.org/en-US/firefox/new/)
• 7-Zip file archiver (https://www.7-zip.org/download.html)
• OWASP BWA VM (https://sourceforge.net/projects/owaspbwa/files/)
• Burp Proxy Community or Professional (https://portswigger.net/burp/)
• Oracle Java (https://www.oracle.com/java/technologies/downloads/)

How to do it...

For this recipe, you will need to download the OWASP BWA VM and install it by performing the following steps:

1. Click Download Latest Version after clicking the OWASP BWA VM link provided earlier and unzip the OWASP_Broken_Web_Apps_VM_1.2.7z file.
2. You will be presented with a listing of several files, as follows:

Figure 1.4 – File listing after unzipping OWASP_Broken_Web_Apps_VM_1.2.7z

3. All file extensions shown indicate that the VM can be imported into Oracle VirtualBox or VMware Player/Workstation. To set up the web application pentesting lab for this book, we will use Oracle VirtualBox.
4. Make a note of the OWASP Broken Web Apps-cl1.vmdk file. Open VirtualBox Manager (that is, the Oracle VM VirtualBox program).
5. Within the VirtualBox Manager screen, select Machine | New from the top menu and type a name for the machine – for example, OWASP BWA.
6. Set Type to Linux and Version to Ubuntu (64-bit), and then click Next, as follows:

Figure 1.5 – Create Virtual Machine

7. The next screen allows you to adjust the RAM or leave it as-is. Click Next.
8. On the next screen, choose Use an existing virtual hard disk file.
9. Use the folder icon on the right to select the OWASP Broken Web Apps-cl1.vmdk file from the extracted list and click Create, as follows:

Figure 1.6 – Hard disk allocation

10. Your VM will have been loaded into VirtualBox Manager. Let’s make some minor adjustments. Highlight the OWASP BWA entry and select Settings from the top menu.
11. Select the Network section in the left-hand pane and change Attached to: to Host-only Adapter. Click OK:

Figure 1.7 – Network adapter settings

12. Now, let’s start the VM. Right-click and then choose Start | Normal Start:

Figure 1.8 – Starting the VM

13. Wait until the Linux system is fully booted, which may take a few minutes. After the booting process is complete, you should see the following screen. Note that the IP address shown will be different for your machine:

Figure 1.9 – Your assigned IP address for the VM

14. The information presented on this screen identifies the URL where you can access vulnerable web applications running on the VM. For example, in the previous screenshot, the URL is http://192.168.56.101/. You will be given a prompt to administer the VM, but it is not necessary to log in at this time.
15. Open the Firefox browser on your host system, not in the VM. Using the Firefox browser on your host machine, enter the URL provided (for example, http://192.168.56.101/), where the IP address is specific to your machine.
16. In your browser, you will be presented with an index page containing links to vulnerable web applications. These applications will be used as targets throughout this book:

Figure 1.10 – Splash page of the VM

How it works…

Leveraging a customized VM created by OWASP, we can quickly set up a web app pentesting lab containing purposefully vulnerable applications that we can use as legal targets for our exercises throughout this book.

In this edition, we’ve added more web security-related labs to enrich your experience with Burp Suite. To follow along and complete these labs, you must register an account with PortSwigger.

PortSwigger provides free, online web security training through Web Security Academy (https://portswigger.net/web-security). Academy consists of learning materials, hands-on labs, and practice exams. We will use some of these labs to demonstrate hacking techniques within this book.

Getting ready

Browse to the PortSwigger site (https://portswigger.net/) and look for the LOGIN button. Click the LOGIN button to navigate to the login page, which has a registration button:

Figure 1.11 – PortSwigger LOGIN button

How to do it…

Follow these steps:

1. Go to https://portswigger.net/users and select the Create account button at the bottom, next to the Log In button:

Figure 1.12 – The Create account button

2. You must provide a valid email address to receive your password for logging into the site:

Figure 1.13 – PortSwigger account creation page

You should receive the password for the account within a short amount of time.

For non-Windows users or those Windows users who chose the plain JAR file option, you will start Burp at a command line each time you wish to run it. As such, you will require a particular Java command to do so.

In some circumstances, such as automated scripting, you may wish to invoke Burp at the command line as a line item in your shell script. Additionally, you may wish to run Burp without a Graphical User Interface (GUI), referred to as headless mode. This recipe describes how to perform these tasks.

How to do it...

We will review the commands and actions required to start the Burp Suite product:

• After running the installer from the downloaded .exe file, start Burp in Windows by double-clicking the icon on your desktop or selecting it from the programs listing:

Figure 1.14 – Burp Suite menu items after installation

• When using the plain JAR file, the java executable is followed by the option of -jar, followed by the name of the download JAR file.

Start Burp at the command line (minimal) with the plain JAR file (Java must be installed first):

C:\Burp Jar Files>java -jar burpsuite_pro_v2023.4.3.jar

If you wish to have more control over the heap size settings (that is, the amount of memory allocated for the program), you may modify the java command.

The java executable is followed by -jar, followed by the memory allocation. In this case, 2 GB (that is, 2g) is allocated for read access memory (RAM), followed by the name of the JAR file. If you receive an error to the effect that you cannot allocate that much memory, just drop the amount down to something like 1,024 MB (that is, 1024m) instead.

Start Burp at the command line (optimize) with the plain JAR file (Java must be installed first):

C:\Burp Jar Files>java -jar -Xmx2g burpsuite_pro_v2023.4.3.jar

• It is possible to start Burp Suite from the command line and run it in headless mode. Headless mode means running Burp without the GUI.

Note

For this book, we will not be running Burp in headless mode since we are learning through the GUI. However, you may require this information in the future, which is why it is presented here.

Start Burp Suite from the command line so that it can be run in headless mode with the plain JAR file (Java must be installed first):

C:\Burp Jar Files>java -jar -Djava.awt.headless=true burpsuite_
pro_v2023.4.3.jar

Note the placement of the -Djava.awt.headless=true parameter immediately following the -jar option and before the name of the JAR file.

If successful, you should see the following:

proxy: Proxy service started on 127.0.0.1:8080

Press Ctrl + C or Ctrl + Z to stop the process.

It is possible to provide a configuration file to the headless mode command so that you can customize the port number and IP address where the proxy listener is located.

Note

Please consult PortSwigger’s support pages for more information on this topic: https://support.portswigger.net/customer/portal/questions/16805563-burp-command-line.

In each startup scenario described, you should be presented with a splash screen:

1. The splash screen label will match whichever edition you decided to download, either Professional or Community:

Figure 1.15 – Burp Suite splash screen

2. You may be prompted to update the version; feel free to do this, if you like. New features are constantly added to Burp to help you find vulnerabilities, so upgrading the application is a good idea. Choose Update Now, if applicable.
3. Next, you will be presented with a dialog box asking about project files and configurations:

Figure 1.16 – Project options upon startup

4. If you are using the Community edition, you will only be able to create a temporary project. If you are using the Professional edition, create a new project on disk, saving it in an appropriate location so that you can find it. Click Next.
5. The subsequent splash screen will ask you about the configurations you would like to use. At this point, we don’t have any yet, so choose Use Burp defaults. As you progress through this book, you may wish to save configuration settings and load them from this splash screen in the future, as follows:

Figure 1.17 – Configuration options upon startup

6. Finally, we are ready to click Start Burp.

How it works...

Using either the plain JAR file or the Windows executable, you can launch Burp to start the proxy listener to capture HTTP traffic. Burp offers temporary or permanent project files so that you can save activities performed in the suite.

Burp is described as an intercepting proxy. This means Burp sits between the user’s web browser and the application’s web server and intercepts or captures all the traffic flowing between them. This type of behavior is commonly referred to as a proxy service.

Penetration testers use intercepting proxies to capture traffic flowing between a web browser and a web application for analysis and manipulation. For example, a tester can pause any HTTP request, thus allowing parameter tampering before the request is sent to the web server.

Intercepting proxies, such as Burp, allow testers to intercept both HTTP requests and HTTP responses. This allows a tester to observe the behavior of the web application under different conditions. And, as we shall see, sometimes the behaviors are unintended, deviating from what the original developer expected.

To see Burp Suite in action, you need to configure your Firefox browser’s Network Settings so that they point to your running instance of Burp. This enables Burp to capture all HTTP traffic that is flowing between your browser and the target web application.

Getting ready

We will configure the Firefox browser to allow Burp to listen to all HTTP traffic flowing between the browser and the OWASP BWA VM. This will allow the proxy service within Burp to capture traffic for testing purposes.

Instructions for this are available on PortSwigger at https://support.portswigger.net/customer/portal/articles/1783066-configuring-firefox-to-work-with-burp. We will step through this process in this recipe.

How to do it...

Follow these steps to start listening to all HTTP traffic using Burp:

1. Open the Firefox browser and go to Options.
2. In the General tab, scroll down to the Network Proxy section and then click Settings.
3. In the Connection Settings window, select Manual proxy configuration and type in an IP address of 127.0.0.1 with the port set to 8080. Select the Use this proxy server for all protocols checkbox.

Make sure the No proxy for text box is blank, as shown in the following screenshot, and then click OK:

Figure 1.18 – Manually configuring the Firefox browser to send HTTP traffic to Burp

4. With the OWASP BWA VM running in the background and using Firefox to browse to the URL specific to your machine (that is, the IP address shown on the Linux VM in VirtualBox), click the reload button (the arrow in a circle) to see the traffic captured in Burp.
5. If you don’t happen to see any traffic, check whether Proxy | Intercept is holding up the request. If the button labeled Intercept is on is depressed, as shown in the following screenshot, then click the button again to disable the interception. After doing so, the traffic should flow freely into Burp, as follows:

Figure 1.19 – By default, Intercept is on

In the following screenshot, the Proxy | Intercept button is disabled:

Figure 1.20 – Turning Intercept off to see traffic

6. If everything is working properly, you will see traffic in your Target | Site map tab, similar to what is shown in the following screenshot. Your IP address will be different, of course, and you may have more items shown within your Site map area. Congratulations! You now have Burp listening to all of your browser traffic!

Figure 1.21 – Confirmation of HTTP traffic flowing into Burp

How it works...

The Burp Proxy service is listening on 127.0.0.1 at port 8080. Either of these settings can be changed so that you can listen on an alternative IP address or port number. However, for learning purposes, we will use the default settings.

There’s more…

As a simpler alternative, you can use the browser built into Burp. To access this, go to Proxy from the top menu, choose the Intercept sub-menu, and then click the Open browser button:

Figure 1.22 – Using Burp’s built-in browser instead of using an external browser (for example, Firefox)