Tag Info

Hot answers tagged

34

Burp Suite in proxy mode is able to decrypt HTTPS traffic of any systems which trust it. It does this by generating an own certificate and use this cert to register itself as a certificate authority on the system it is installed on. When it then proxies a request to a HTTPS webserver, it does the HTTPS handshake itself, decrypts the traffic, issues a ...


15

Along with advice on how to use Burp, you should also not forget to customise the following: Form Submission: To set suitable names and values for forms submitted by Burp, as I presume you don't want to send 'Weiner' :-) Within the Burp window - navigate to the 'Spider' tab and then the 'options' menu. From here you should update the standard values ...


12

There are a lot of free tools out there. You may not find a free tool with the exact same functionality as Burp, but you could use several tools to compensate for the limitations of Burp's free version. use Owasp ZAP or Webscarab for their proxy functionality. use Nikto and W3AF to scan web applications. use SQLMap to exploit SQL injections ...


12

In this case the first \ is escaping an escape to provide attacker with a un-escaped double-quote: var x="\\";alert('XSS');//" This is assuming the target application has a broken escape routine.


8

Burp is an intercepting Proxy, which lets you inspect and modify traffic between your browser and the target application. Burp is actually serving it's own certificate so that you can see what's inside the request. Normally you will have accepted a security warning for a certificate issued by Portswigger, this is the certificate generate by Burp. If you ...


7

In short, you don't need SOFTWARE, you need KNOWLEDGE. Seek that first, then the tools can help.


6

Absolutely absolutely pick up the Web Application Hackers Handbook by Portswigger (author of Burp), which is written as both an introduction to the concepts relevant to Web App reversing / hacking, but also as a step-by-step guide for applying those concepts with Burp Suite. Note that the Second Edition is now available.


6

One good sequence of tutorials I've seen is on the Security Ninja site. That links got the last one in the series (focuses on the scanner tab) but there's links to the other ones from that page.


6

The purpose of the string is to test if JavaScript injection is possible. It will not do harm itself, only show an alert box with the message "XSS" which would mean that you successfully injected the website with some JavaScript. Then, an attacker could inject any JS to perform an XSS attack.


4

In your question, you mention that the app displays the text of the captcha right under it. If you mean that the correct answer to the captcha challenge is displayed to the user as text in addition to its display in an image, then it should be a simple matter to script an automated scan. Your script would be able to complete the login process by reading the ...


4

BurpSuite is only used to send HTTP requests in an automated way. There is no way to tell if a request is coming from BurpSuite or not. (Just have a look at your request header or body). You might be able to detect such a robot though. Tools such as BurpSuite use a scanner, and you can trap them by making them follow an invisible link on your website. Tools ...


4

Burp can use an upstream proxy server. You would set up your browser to use your burp instance (usually localhost:8080), and in Burp's options, you can set your company's proxy server (say: proxy.company.com:8080). All traffic will pass through your company's server, after it has been handled using Burp. To help auditing both internal (intranet) and ...


3

Appscan has the "show in browser" feature that opens Appscan's special "worst of all worlds" browser for the given vulnerability. If it isn't a false positive, this browser should execute the Javascript. I have found it a pretty reliable way to check for false positives. For all other testing, I've found that Firefox is the least protected from XSS, so I ...


3

You can do this using the Proxy tool (tab) of Burp. Just be sure that you added the host (msn.com in this case) to the Scope and check the "Intercept server responses..." check box on the Options tab (under Proxy). This way all the server responses will be displayed on the Intercept tab where you can place arbitrary content in them. You can also use the ...


3

First question I'd ask is do you have the Pro (paid for) version of Burp Suite? Scanner functionality isn't available in the free version so that would explain the problem you're seeing.


3

Try to use Makros at: Options -> Sessions -> Session Handling -> Add -> Rule Actions and enable the Sequencer at the Scope Tab within the Session handling rule editor. Looks like you have to define Makros to "visit the Link" aka call the URL the link points to with the given Token. Look around the Sessions-Tab for the appropiate way to accomplish the task.


2

This one from SalesForce seems okay - a wee bit basic if you have used burp before.


2

Have you looked at burps support for Invisible proxying? It sounds like it would help with the test you're looking at as it's designed to let burp work with non-proxy aware clients.


2

I maybe completely wrong because I don't have a phone to test it, but if your computer provided a WiFi access point, then the phone would route to it. If you tethered your computer back to your phone, I believe all tethered traffic goes over the cellular side. If that works, then you have a nice circular route without any need to be jailbroken. Since you ...


2

Normally when you start the Interception, your burp suite will provide it's own SSL certificate which would create a "warning" to your browser. Using this, you're talking to Burp before it sends it off to the target site. On another note, once the user is logged in, you don't switch back to HTTP, do you? (Since you said: "we display the login page to the ...


2

It sounds like you are asking how to get an automated tool to log into a site that offers two factor authentication. With the limited info you provided, there are four approaches that come to mind. use the tool's manual spidering facility. Many automated tools offer the ability to manually drive the tool, then transition to automated spidering/testing. ...


1

I am not 100% sure about this, but I think it highlights a severe vulnerability in the application that you are reviewing: Normally, when an application connects through https, it creates a secure connection and validates that the certificate has been signed by a trusted Certificate Authority, that it is still valid and, on occasion, that it has not been ...


1

There are no specific tool to hack. If you want to "hack" on the web , you will generally use technology that are available on the web; example Javascript. First, I would start by learning how things work in general on a website and then you will see some possible vulnerability and understand why we do certain things to block them. Owasp is a very good site ...


1

First - Nessus checks for vulnerabilities. There's a massive array of places to get educated. If you're wanting to learn for illegal activities, you're on your own. If it's for ethical hacking aka penetration testing then check these out: The Basics of Hacking and Penetration Testing, Second Edition [Book] Sans.org [Classes, free white papers] OWASP [A-Z ...


1

Your IP is blacklisted for a reason, not just because you use Burp or Appscan. A possibility is that they have a mechanism to detect: Too many connections to the site An offending User-Agent Too many malicious HTTP requests Try to discover first how or why it classifies you as malicious and try to circumvent then the protection. Web sites does not ...


1

Use a proxy. Either a webbased one like hidemyass or ixquick. Or a http/socks based proxy. You can find free ones listed all over the place, including hidemyass. If you need to run applications that do not provide built in proxy settings then use a wrapper such as proxychains.


1

I am not sure about this scenario, but think of it like this. The application is providing, a javascript an input from what the user provided. Like <script> somecode "some value the user input here" alert('XSS');// </script> In that situation, the Script tags are not necessey, but only the code will work as an XSS. For such a situation, ...


1

You aren't understanding the concept of the darnket properly. There is no exit traffic for the darnket (as applied to TOR). All you would see is the encrypted traffic. Analysis of the sites on the general internet being hit through your exit node would be another story.


1

That's normal since your traffic is already encapsulated with several layers of encryption (a layer per node through which your traffic travels). You can only analyze Tor before the traffic enters the network or you could set up an exit node and find all traffic which is coming out of the Tor network (this would be less valuable in your case). Have a read ...


1

Take a look at CAT (Context Application Test) Tool. Its written by a apploication security consultancy in the UK. It has functionality very similar to Burp (intruder, proxy, repeater, fuzzer), it also has an API so you can develop your own plugins. http://www.contextis.com/research/tools/cat/



Only top voted, non community-wiki answers of a minimum length are eligible