1

I have recently started using Burp as a proxy for hunting bugs on websites and I see many submissions where people have intercepted and modified requests/responses to exploit certain logic flaws in web applications. However, this is possible only because we have installed Burp's certificate in our browser that allows it to decrypt the traffic to and from the web application. However, in a realistic scenario, the attacker would have to conduct a MITM attack to intercept/modify traffic. This makes me wonder what the point is of traffic interceptions using Burp.

  • Can you list a few examples? That might help others answer the question – Limit Jun 30 at 2:00
  • For example, I am testing an application where I'm able to bypass a client-side control - a security question - to edit a page by modifying the server's response. However, I can't reproduce this on another user's session without doing a MITM – Dino Jun 30 at 2:19
2

The purpose of HTTP interception proxies is not to MitM requests of another user, and does not represent such attacks like you have stated. Instead, the purpose is to modify/craft requests in different ways in order to search for vulnerabilities in the way the backend handles requests.

Example: You are testing a website's form field for SQL injection or XSS. However, the form field has strict validation on the characters you are allowed to enter (e.g. no symbols, which are fairly essential for those attacks). Even though the frontend may have strict validation, the backend may not. By using an HTTP interception proxy, you can modify a frontend validated request to contain characters that weren't allowed, sending them directly to the backend. Then, you can observe the response for evidence of the vulnerability.

Of course, this is just one example and there are many other uses, but hopefully you understand that it is more about testing inputs rather than a hypothetical MitM attack.

| improve this answer | |
0

However, in a realistic scenario, the attacker would have to conduct a MITM attack to intercept/modify traffic.

In a realistic attack scenario where the attacker seeks to intercept data off a browser, yes. They would probably not bother with burp though.

This makes me wonder what the point is of traffic interceptions using Burp.

To conduct research, to observe and modify HTTP traffic (and to an extent websocket traffic), to perform penetration testing work, to explore/modify/attack client side operations. Exactly as you said "...for hunting bugs on websites and I see many submissions where people have intercepted and modified requests/responses to exploit certain logic flaws in web applications....

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.