0

Are the attacks being performed using burpsuite detectable? If yes, how should we stay anonymous/secure while conducting web application reconnaissance?

5

BurpSuite is only used to send HTTP requests in an automated way. There is no way to tell if a request is coming from BurpSuite or not. (Just have a look at your request header or body).

You might be able to detect such a robot though. Tools such as BurpSuite use a scanner, and you can trap them by making them follow an invisible link on your website. Tools would automatically follow the link whereas users wouldn't even notice it. If someone visits the website.com/trap link, you can tell it's a scanner.

BurpSuite is just a tool, attacks can also be performed manually, just think about BurpSuite as a web browser with automated actions to help finding vulnerabilities. (Yeah, I know it's more than that, but all it does is send HTTP requests).

  • Well I understand your point, but what if I'm sending hundreds of requests per minute like in the case of burp-intruder, Won't that compromise my identity to the administrator? – Asak Apr 29 '14 at 9:13
  • Why would it? If you opened your browser and kept the F5 key pressed, would it compromise your identity? Of course the administrator will see a strange traffic coming from your IP address. But BurpSuite has nothing to do with that. – Corneliux Apr 29 '14 at 9:32
  • haha okay fair enough but let me ask one more question,I was once checking for bypassing authentication using burp-intruder using a legitimate username but after 10-15 retries that account got locked out.Now my question is that did the application did that lockout or the administrator after seeing requests coming from my burp? thanks – Asak Apr 29 '14 at 9:38
  • No! There's no way to see it's coming from Burp. The account may have been locked out after too many failed authentications or a system detecting suspicious traffic. Think of it as if you were checking your logs. If you see 10 requests for user 'j.doe' with passwords 'aaa', 'aab', 'aac' and so on, it is legitimate to think a bruteforce is in progress. Again, nothing to do with burp. I don't think you get what burp really is... – Corneliux Apr 29 '14 at 9:58
  • Forgot to mention that such systems detect too many failed authentications in a given time frame. Normal users usually aren't fast enough to try 100 passwords per second... Only tools can do that. So you got spotted, but nobody could tell you did that with burp. (It could be your own python script or something else). – Corneliux Apr 29 '14 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.