Burp Suite is a popular platform for performing security testing of web applications. It can also be used by a malicious party to analyze and attack web applications. Implemented in Java.

learn more… | top users | synonyms

1
vote
2answers
55 views

How can I use the free version of Burp to identify input HTTP urls for my site [closed]

I want to create (and update ongoing) a list of input vectors for my site, including forms (GET and POST etc). I am new to pen tesing, and have been pointed at Burp (free). I have Spidered my site, ...
3
votes
1answer
63 views

SQLMap on a seqential form

There is a certain form that gets posted over POST. The form has some form elements. I am doing a pen-test on the application that has this form. The form values are being stored in a certain ...
0
votes
2answers
176 views

How do google or facebook know I'm behind a man in the middle proxy?

Whenever I'm behind a man in the middle proxy such as burp, and try to access either google or facebook, I get an alert message telling me that the connection is not reliable and blocks the page from ...
0
votes
1answer
275 views

Burp Suite is not intercepting JSON responses [closed]

I am trying this video and this video to learn pen-testing using JSON injection. Burp Suite is able to intercept the request from the page, but not getting the JSON response. How to solve that?
2
votes
1answer
336 views

SSL traffic manipulation through ettercap MitM and iptables

I am trying to understand the relation between some tools and concepts used for MitM on a wifi network and how https transaction (over this wifi network) between an android app and the respective ...
0
votes
1answer
128 views

JSON and form-urlencoded encoded payloads in Burp Intruder

The application I'm running a security assessment on encodes POST requests as follows: POST /foo/save HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: ...
1
vote
2answers
270 views

Credentialed scans and the Burp Suite active Scanner

I have been running scans on a few web applications that require a typical username and password to gain access to the website. I usually remain logged in through the browser my proxy is running ...
2
votes
4answers
465 views

Intercepting AJAX request and response using BURP

I would like to intercept an AJAX request using BURP. I have used BURP for web applications testing before. This, however, appears to be a weird case. I am not certain what am I missing here. The ...
0
votes
2answers
110 views

Burp suite - trying all parameters such as numbers|numbers

A website I'm looking at for my colleagues has a parameter which is number|number Where the likely values will be 1-99|1-999 (e.g. 14|234) How do I configure burp to try all possible values? (Would ...
0
votes
1answer
47 views

Working of Burp [closed]

I want to know How does burp decides whether the attack has been successful or not. When I send a request through burp the server give http response code as 500, what does this mean Session lost ...
2
votes
0answers
36 views

Burp warning whenever I write a rule?

Whenever I write rule and save it in burp it gives this warning, I am not able to find out why it warns me The rule is not in-scope for any URLs. Are you sure yu want to proceed? While the rule is ...
2
votes
1answer
165 views

How to run multiple session while scanning application through Burp?

While the scanning the application through Burp, I found that if I use multiple threads it is resulting to session errors like (The requested session id appears to be invalid.You may have more than ...
0
votes
1answer
330 views

iptables intercept received packet with proxy and then forward to destination

Lets say I receive internet through my eth1 port and share it via hotspot to other devices (wlan0 port) [internet]----(eth1)[my computer](wlan0 hotspot) | ...
4
votes
1answer
187 views

Burp Suite Active Scanning Wizard options

I have been making use of Burp Suite's active scanning functionality for some of my recent web application assessments and I had some questions about the active scanners ability to remove urls from ...
1
vote
3answers
3k views

SSL interception with Burp Suite using Firefox - Strange behavior when intercepting twitter

I am learning Burp Suite(Free Edition v1.6). I have set it up with the default settings. The proxy listener is listening to 127.0.0.1 on port 8080 and Certificate option is set to 'Generate CA-signed ...
23
votes
2answers
3k views

Passwords in plaintext?

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, I opened up the App on my iPhone and started to sniff some traffic. I pressed the "login" ...
1
vote
2answers
494 views

Testing XSS - how to validate manually?

I have Burp and Appscan telling me that Reflected XSS is possible due to a particular variable on a particular page. The following example is given of what Appscan injected ...
3
votes
1answer
4k views

How to configure Burp suite in browsers while my internet connection works behind proxy.?

I could not able to configure burp suite with browsers. If I use manual connection settings in browsers,I could not load any site.Because my company uses proxy. Following Methods I have tried but ...
0
votes
4answers
270 views

Software for web hacking? [closed]

I want to learn sql injection, xss and other web attacks. I am new to all this, just a beginner. I want to know which software to use. Can I use Windows for these attacks ...
3
votes
2answers
458 views

how to scan a web application that uses Captcha

I have a web application I am doing a security assessment on and it uses captcha for both the login and for certain operations inside the app. The interesting thing is that this particular app ...
0
votes
0answers
165 views

HTTPS site not being captured by BURP

I am testing a website, basically mapping the site using burpsuite. But there is one link(https) that I can not process while the proxy on firefox is enabled. It asks me for certificates and when I ...
0
votes
1answer
269 views

BurpSuite: Anonymity

Are the attacks being performed using burpsuite detectable? If yes, how should we stay anonymous/secure while conducting web application reconnaissance?
0
votes
2answers
880 views

How can I Bypass ip block mechanism?

I want to pentest a specific web application with automatic tool like Burp Suite and IBM Security AppScan. However, the website uses a prevention mechanism for attack. When I started automatic tool, ...
3
votes
2answers
978 views

Form submissions over HTTPS are not encrypted?

My question is regarding HTTPS form submission. One of our website is using HTTPS, we display the login page to the user via HTTPS protocol. When the form is submitted, if we try to intercept the ...
-6
votes
1answer
430 views

How can I succesfully pentest site with two factor authentication? [closed]

I want to use a commercial, automated tool but it cannot login successfully because the website requires a two factor authentication process using SMS. For testing, the SMS message is sent to another ...
0
votes
1answer
248 views

“Scanner” tab disabled in Burp Suite [closed]

I am new to using Burp Suite. I am trying to learn how to use it with Mutillidae and DVWA. Whenever I right-click on any particular application the "Actively scan this branch/host" and "Passively scan ...
9
votes
3answers
463 views

How could the string \";alert('XSS');// be used for XSS?

I was using Burp Suite for some testing and I noticed that they included the following string: \";alert('XSS');// as an attack string for an XSS payload. How could this string be used to execute ...
3
votes
1answer
951 views

How to MiTM insert an iframe using burp or another tool?

So, I am trying to obtain a cookie without the secure flag enabled over HTTPS. After reading about it, I came across an answer: You visit https://secure.example.com/ which drops a cookie on your ...
2
votes
3answers
1k views

Using Tor from behind a Proxy (like Burp Suite)

I am interested in exploring a bit of the darknet, and I was wondering about the feasibility of running a Tor exit node from behind a local proxy like Burp Suite so that I could ID the destination ...
5
votes
5answers
8k views

Affordable web application attack tools

I've been using Burp Intruder (part of Burp suite), but in the free edition of Burp Suite the Intruder functionality is Time-throttled. As a student pen tester however, I can't justify the cost of ...
2
votes
1answer
362 views

Route traffic from iPhone to desktop and back

I have some iOS app to pentest, and the target server is accessible only through the jailbroken iPhone's APN. My problem is, that I want to configure the traffic in such way so I can intercept and ...
6
votes
1answer
273 views

How exactly does Burp Sequencer calculate the values it derives?

I'm testing a Web application based on SAP for a customer. One of the checks we normally do is to analyse the cookie holding the session token to make sure that it is sufficiently random and you ...
3
votes
1answer
623 views

Burp proxy between non proxy aware device

I want to intercept traffic between a Ethernet connected device, which is not proxy aware and modify/inject javascript. Conventionally when testing webapps I would use burp. Can burp sit on my ...
4
votes
1answer
624 views

Burpsuite Pro: CSRF tokens in sequencer

So I'm using Burp to try and estimate the entropy used by tokens to prevent CSRF. Let's say a website has a url in it's site protected by a Token: <a ...
18
votes
5answers
3k views

Where can I find a solid BURP tutorial? [closed]

I'm looking for a good resource for learning/configuring BURP. I understand the concepts behind using the framework, and have read the docs on the site, but if anyone has a solid tutorial link I ...