Hot answers tagged burp
Along with advice on how to use Burp, you should also not forget to customise the following: Form Submission: To set suitable names and values for forms submitted by Burp, as I presume you don't want to send 'Weiner' :-) Within the Burp window - navigate to the 'Spider' tab and then the 'options' menu. From here you should update the standard values ...
There are a lot of free tools out there. You may not find a free tool with the exact same functionality as Burp, but you could use several tools to compensate for the limitations of Burp's free version. use Owasp ZAP or Webscarab for their proxy functionality. use Nikto and W3AF to scan web applications. use SQLMap to exploit SQL injections ...
One good sequence of tutorials I've seen is on the Security Ninja site. That links got the last one in the series (focuses on the scanner tab) but there's links to the other ones from that page.
Absolutely absolutely pick up the Web Application Hackers Handbook by Portswigger (author of Burp), which is written as both an introduction to the concepts relevant to Web App reversing / hacking, but also as a step-by-step guide for applying those concepts with Burp Suite. Note that the Second Edition is now available.
Try to use Makros at: Options -> Sessions -> Session Handling -> Add -> Rule Actions and enable the Sequencer at the Scope Tab within the Session handling rule editor. Looks like you have to define Makros to "visit the Link" aka call the URL the link points to with the given Token. Look around the Sessions-Tab for the appropiate way to accomplish the task.
You can do this using the Proxy tool (tab) of Burp. Just be sure that you added the host (msn.com in this case) to the Scope and check the "Intercept server responses..." check box on the Options tab (under Proxy). This way all the server responses will be displayed on the Intercept tab where you can place arbitrary content in them. You can also use the ...
I maybe completely wrong because I don't have a phone to test it, but if your computer provided a WiFi access point, then the phone would route to it. If you tethered your computer back to your phone, I believe all tethered traffic goes over the cellular side. If that works, then you have a nice circular route without any need to be jailbroken. Since you ...
There is an explanation of the types of statistical tests that Burp Sequencer performs to test randomness. Below is the initial high level description and the page goes on to describe characteristics of the individual tests that are run which include character and bit analysis of the token data. Burp Sequencer employs standard statistical tests for ...
That's normal since your traffic is already encapsulated with several layers of encryption (a layer per node through which your traffic travels). You can only analyze Tor before the traffic enters the network or you could set up an exit node and find all traffic which is coming out of the Tor network (this would be less valuable in your case). Have a read ...
Take a look at CAT (Context Application Test) Tool. Its written by a apploication security consultancy in the UK. It has functionality very similar to Burp (intruder, proxy, repeater, fuzzer), it also has an API so you can develop your own plugins. http://www.contextis.com/research/tools/cat/
Only top voted, non community-wiki answers of a minimum length are eligible