Burp Suite is a popular platform for performing security testing of web applications. It can also be used by a malicious party to analyze and attack web applications. Implemented in Java.

learn more… | top users | synonyms

1
vote
2answers
46 views

How can I use the free version of Burp to identify input HTTP urls for my site [closed]

I want to create (and update ongoing) a list of input vectors for my site, including forms (GET and POST etc). I am new to pen tesing, and have been pointed at Burp (free). I have Spidered my site, ...
2
votes
4answers
330 views

Intercepting AJAX request and response using BURP

I would like to intercept an AJAX request using BURP. I have used BURP for web applications testing before. This, however, appears to be a weird case. I am not certain what am I missing here. The ...
3
votes
1answer
44 views

SQLMap on a seqential form

There is a certain form that gets posted over POST. The form has some form elements. I am doing a pen-test on the application that has this form. The form values are being stored in a certain ...
1
vote
3answers
2k views

SSL interception with Burp Suite using Firefox - Strange behavior when intercepting twitter

I am learning Burp Suite(Free Edition v1.6). I have set it up with the default settings. The proxy listener is listening to 127.0.0.1 on port 8080 and Certificate option is set to 'Generate CA-signed ...
2
votes
0answers
243 views

SSL traffic manipulation through ettercap MitM and iptables

I am trying to understand the relation between some tools and concepts used for MitM on a wifi network and how https transaction (over this wifi network) between an android app and the respective ...
0
votes
2answers
159 views

How do google or facebook know I'm behind a man in the middle proxy?

Whenever I'm behind a man in the middle proxy such as burp, and try to access either google or facebook, I get an alert message telling me that the connection is not reliable and blocks the page from ...
0
votes
1answer
125 views

Burp Suite is not intercepting JSON responses [closed]

I am trying this video and this video to learn pen-testing using JSON injection. Burp Suite is able to intercept the request from the page, but not getting the JSON response. How to solve that?
0
votes
1answer
78 views

JSON and form-urlencoded encoded payloads in Burp Intruder

The application I'm running a security assessment on encodes POST requests as follows: POST /foo/save HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: ...
2
votes
3answers
1k views

Using Tor from behind a Proxy (like Burp Suite)

I am interested in exploring a bit of the darknet, and I was wondering about the feasibility of running a Tor exit node from behind a local proxy like Burp Suite so that I could ID the destination ...
1
vote
2answers
185 views

Credentialed scans and the Burp Suite active Scanner

I have been running scans on a few web applications that require a typical username and password to gain access to the website. I usually remain logged in through the browser my proxy is running ...
0
votes
2answers
95 views

Burp suite - trying all parameters such as numbers|numbers

A website I'm looking at for my colleagues has a parameter which is number|number Where the likely values will be 1-99|1-999 (e.g. 14|234) How do I configure burp to try all possible values? (Would ...
1
vote
2answers
418 views

Testing XSS - how to validate manually?

I have Burp and Appscan telling me that Reflected XSS is possible due to a particular variable on a particular page. The following example is given of what Appscan injected ...
0
votes
1answer
46 views

Working of Burp [closed]

I want to know How does burp decides whether the attack has been successful or not. When I send a request through burp the server give http response code as 500, what does this mean Session lost ...
2
votes
0answers
34 views

Burp warning whenever I write a rule?

Whenever I write rule and save it in burp it gives this warning, I am not able to find out why it warns me The rule is not in-scope for any URLs. Are you sure yu want to proceed? While the rule is ...
2
votes
1answer
130 views

How to run multiple session while scanning application through Burp?

While the scanning the application through Burp, I found that if I use multiple threads it is resulting to session errors like (The requested session id appears to be invalid.You may have more than ...
4
votes
1answer
164 views

Burp Suite Active Scanning Wizard options

I have been making use of Burp Suite's active scanning functionality for some of my recent web application assessments and I had some questions about the active scanners ability to remove urls from ...
0
votes
1answer
261 views

iptables intercept received packet with proxy and then forward to destination

Lets say I receive internet through my eth1 port and share it via hotspot to other devices (wlan0 port) [internet]----(eth1)[my computer](wlan0 hotspot) | ...
23
votes
2answers
3k views

Passwords in plaintext?

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, I opened up the App on my iPhone and started to sniff some traffic. I pressed the "login" ...
2
votes
1answer
3k views

How to configure Burp suite in browsers while my internet connection works behind proxy.?

I could not able to configure burp suite with browsers. If I use manual connection settings in browsers,I could not load any site.Because my company uses proxy. Following Methods I have tried but ...
0
votes
4answers
264 views

Software for web hacking? [closed]

I want to learn sql injection, xss and other web attacks. I am new to all this, just a beginner. I want to know which software to use. Can I use Windows for these attacks ...
3
votes
2answers
391 views

how to scan a web application that uses Captcha

I have a web application I am doing a security assessment on and it uses captcha for both the login and for certain operations inside the app. The interesting thing is that this particular app ...
0
votes
0answers
144 views

HTTPS site not being captured by BURP

I am testing a website, basically mapping the site using burpsuite. But there is one link(https) that I can not process while the proxy on firefox is enabled. It asks me for certificates and when I ...
0
votes
1answer
258 views

BurpSuite: Anonymity

Are the attacks being performed using burpsuite detectable? If yes, how should we stay anonymous/secure while conducting web application reconnaissance?
0
votes
2answers
816 views

How can I Bypass ip block mechanism?

I want to pentest a specific web application with automatic tool like Burp Suite and IBM Security AppScan. However, the website uses a prevention mechanism for attack. When I started automatic tool, ...
3
votes
2answers
937 views

Form submissions over HTTPS are not encrypted?

My question is regarding HTTPS form submission. One of our website is using HTTPS, we display the login page to the user via HTTPS protocol. When the form is submitted, if we try to intercept the ...
2
votes
1answer
348 views

Route traffic from iPhone to desktop and back

I have some iOS app to pentest, and the target server is accessible only through the jailbroken iPhone's APN. My problem is, that I want to configure the traffic in such way so I can intercept and ...
-6
votes
1answer
378 views

How can I succesfully pentest site with two factor authentication? [closed]

I want to use a commercial, automated tool but it cannot login successfully because the website requires a two factor authentication process using SMS. For testing, the SMS message is sent to another ...
0
votes
1answer
213 views

“Scanner” tab disabled in Burp Suite [closed]

I am new to using Burp Suite. I am trying to learn how to use it with Mutillidae and DVWA. Whenever I right-click on any particular application the "Actively scan this branch/host" and "Passively scan ...
9
votes
3answers
447 views

How could the string \";alert('XSS');// be used for XSS?

I was using Burp Suite for some testing and I noticed that they included the following string: \";alert('XSS');// as an attack string for an XSS payload. How could this string be used to execute ...
3
votes
1answer
920 views

How to MiTM insert an iframe using burp or another tool?

So, I am trying to obtain a cookie without the secure flag enabled over HTTPS. After reading about it, I came across an answer: You visit https://secure.example.com/ which drops a cookie on your ...
5
votes
5answers
7k views

Affordable web application attack tools

I've been using Burp Intruder (part of Burp suite), but in the free edition of Burp Suite the Intruder functionality is Time-throttled. As a student pen tester however, I can't justify the cost of ...
6
votes
1answer
254 views

How exactly does Burp Sequencer calculate the values it derives?

I'm testing a Web application based on SAP for a customer. One of the checks we normally do is to analyse the cookie holding the session token to make sure that it is sufficiently random and you ...
3
votes
1answer
604 views

Burp proxy between non proxy aware device

I want to intercept traffic between a Ethernet connected device, which is not proxy aware and modify/inject javascript. Conventionally when testing webapps I would use burp. Can burp sit on my ...
4
votes
1answer
592 views

Burpsuite Pro: CSRF tokens in sequencer

So I'm using Burp to try and estimate the entropy used by tokens to prevent CSRF. Let's say a website has a url in it's site protected by a Token: <a ...
18
votes
5answers
3k views

Where can I find a solid BURP tutorial? [closed]

I'm looking for a good resource for learning/configuring BURP. I understand the concepts behind using the framework, and have read the docs on the site, but if anyone has a solid tutorial link I ...