Questions tagged [burp-suite]

Burp Suite is a popular platform for performing security testing of web applications. It can also be used by a malicious party to analyze and attack web applications. Implemented in Java.

Filter by
Sorted by
Tagged with
27
votes
3answers
5k views

Passwords in plaintext?

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, then I opened up the App on my iPhone and started to sniff some traffic. I pressed the "...
20
votes
5answers
5k views

Where can I find a solid BURP tutorial? [closed]

I'm looking for a good resource for learning/configuring BURP. I understand the concepts behind using the framework, and have read the docs on the site, but if anyone has a solid tutorial link I ...
18
votes
7answers
53k views

How to configure Burp Suite for localhost application

I am trying to analyze HTTP traffic of our application. Application uses port 8080. So I had configured burp proxy for 6666 and upstream proxy to our organisation proxy. Made changes to browser's ...
17
votes
7answers
21k views

Affordable web application attack tools

I've been using Burp Intruder (part of Burp suite), but in the free edition of Burp Suite the Intruder functionality is Time-throttled. As a student pen tester however, I can't justify the cost of $...
12
votes
2answers
11k views

What are the differences between Burp and OWASP ZAP?

I am new to security testing and I'm confused about two web proxy tools, namely Burp and OWASP ZAP. Both seem to fulfill the same task, so what exactly are the differences between them?
11
votes
1answer
2k views

Burpsuite accidental defacement, should I be concerned?

I was spidering a website with Burpsuite and the automated Form Submission caused me to unknowingly deface the main page with "555-555-0199@example.com". It took me a decent amount of time to notice ...
10
votes
1answer
5k views

In what situations can element.setAttribute allow XSS?

Burp has identified a potential DOM XSS vulnerability: The application may be vulnerable to DOM-based cross-site scripting. Data is read from window.location.href and passed to the 'setAttribute()' ...
9
votes
3answers
1k views

How could the string \";alert('XSS');// be used for XSS?

I was using Burp Suite for some testing and I noticed that they included the following string: \";alert('XSS');// as an attack string for an XSS payload. How could this string be used to execute ...
8
votes
2answers
19k views

Intercepting Android app traffic with Burp

I am trying to understand what do Burp and Android apps do when the traffic is https. I did not install the Burp CA to the phone. Some apps completely refuse to work. They display an error message or ...
6
votes
1answer
642 views

How exactly does Burp Sequencer calculate the values it derives?

I'm testing a Web application based on SAP for a customer. One of the checks we normally do is to analyse the cookie holding the session token to make sure that it is sufficiently random and you can'...
5
votes
2answers
17k views

How to configure Burp suite in browsers while my internet connection works behind proxy.?

I could not able to configure burp suite with browsers. If I use manual connection settings in browsers,I could not load any site.Because my company uses proxy. Following Methods I have tried but ...
5
votes
4answers
13k views

Burpsuite: just passthrough firefox detect portal

When I enable Burpsuite's Proxy I continiously get http GET requests for firefox's detectportal as seen in the following image: How I can configure it to somehow just pass though theese requests ...
5
votes
1answer
31k views

Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1

Previously I have been able to bypass SSL Pinning by using the program JustTrustMe with the Xposed framework for nearly every app. https://github.com/Fuzion24/JustTrustMe However it has started to ...
5
votes
1answer
1k views

How do I verify that my CSRF fix is successful using Burp?

I know I can use the the Generate CSRF PoC feature to test whether I have a CSRF vulnerability but once I mitigate this, how will Burp recognize this fix on the next scan? I need to be able to ...
5
votes
1answer
9k views

Can a .DER be converted to a .PFX / .P12 ?

Burp-Suite's http://burp/cert:8080 web-interface for downloading the CA Certificate only provides a .der encoded certificate, but for a particular use-case scenario I require a PKCS#12 .pfx/.p12. I ...
5
votes
1answer
934 views

Burp Suite Active Scanning Wizard options

I have been making use of Burp Suite's active scanning functionality for some of my recent web application assessments and I had some questions about the active scanners ability to remove urls from ...
5
votes
1answer
441 views

Is it possible to detect if a proxy is intercepting and sniffing or modifying data

I was watching a video on burp suite and proxies which started me thinking. What if someone setup public proxies that anyone could use and also ran a tool like Burp suite to sniff and/or modify data. ...
5
votes
2answers
6k views

Some specific website not loading when proxy through Burp

I am conducting web application pentest in which all the traffic will go through BurpSuite. In addition, SOCKS proxy is used so all the requests are sending out from a fix company IP address. However,...
4
votes
2answers
1k views

How is HSTS handled on subdomains?

I recently audited a website with three hosts: the main site (example.com), and two subdomains (let's call them portal.example.com, and welcome.example.com). According to the response headers, HSTS ...
4
votes
3answers
2k views

Web App Pentesting: When enumerating website directories and files, how to tell if HTTP 200 is a valid page, or a failure page?

Suppose a web app is being tested where all the functionality is behind a login. One of the tests to be run is to check whether any of the pages are available without log-in. We try the actual url ...
4
votes
1answer
2k views

Strange response body in burp suite

When I capture HTTP requests and responses with Burp suite, everything works fine except when I want to capture facebook.com responses, I get a strange response body which is in some unreadable format ...
4
votes
2answers
2k views

Preventing a Burp and Intercept

I have created an authentication API to manage user sessions and the works. To log a user in, the user send their credentials to my API endpoint and it returns “true” or “false” based on their login. ...
4
votes
1answer
1k views

How to perform custom response grep/extract in Burp Intruder?

Burp Intruder supports response grep by regexp, and shows every match in separate column in result table. Is it possible to use custom response processor, written in any language (Python preferred) ...
4
votes
1answer
4k views

Intercept traffic other than port 80 and 443 on burp suite

I am trying to intercept traffic on port 8000. For example my application is running on abc.com:8000. I am unable to intercept this traffic on burp suite. How can I intercept this traffic in Burp?
4
votes
1answer
1k views

How to run multiple session while scanning application through Burp?

While scanning an application through Burp, I've found that if I use multiple threads, it results to session errors like The requested session id appears to be invalid. You may have more than one Task ...
4
votes
1answer
1k views

Burpsuite Pro: CSRF tokens in sequencer

So I'm using Burp to try and estimate the entropy used by tokens to prevent CSRF. Let's say a website has a url in it's site protected by a Token: <a href="http://example.com/mypage.TOKEN=1234"&...
4
votes
1answer
3k views

How to use Burp macros to pass parameters to intruder

My issue is that I am attempting to fuzz a 2 stage login for a custom webapp. What I need to do is GET for the initial page which will provide me with an anti-csrf token and a sessionID. From there ...
4
votes
1answer
81 views

Android mobile application security testing

I am a newbie to Android application security. I would like to know how to tunnel the Android app traffic to Burp Proxy. I have already set the proxy in the emulator and that is working fine. But the ...
4
votes
4answers
13k views

Intercepting AJAX request and response using BURP

I would like to intercept an AJAX request using BURP. I have used BURP for web applications testing before. This, however, appears to be a weird case. I am not certain what am I missing here. The ...
3
votes
2answers
2k views

Form submissions over HTTPS are not encrypted?

My question is regarding HTTPS form submission. One of our website is using HTTPS, we display the login page to the user via HTTPS protocol. When the form is submitted, if we try to intercept the ...
3
votes
1answer
24k views

Can't Download Burp's CA Certificate from http://burp [closed]

I was trying to download burp's CA certificate for Firefox on Kali from http://burp as specified in its documentation but the site is not available. It redirects me to http://www.inert.com/. So is ...
3
votes
1answer
7k views

How to intercept and replace request URL through Burp Proxy?

I've got a mobile app to test, and the url where requests from mobile app are sent is mapi.example.com, but the company told me that it would be great if I could send all requests to mapitest.example....
3
votes
1answer
12k views

Proxying MetaSploit through BurpSuite

I was wondering how I would be able to proxy MetaSploit through BurpSuite. I was to reverse engineer a packet being sent to my ChromeCast, but I have no way of viewing the packet. Thanks.
3
votes
1answer
4k views

Password shows as plaintext via burp suite interception for HTTPS request, is it an issue?

While intercepting HTTPS using Burp and Burp's certificate is added to the browser, I intercepted a login request and the password shows as plaintext. Does this indicate a vulnerability or is it the ...
3
votes
3answers
13k views

Where is the BurpSuite CA HTTPS certificate located?

Following this question -> Why are HTTPS requests blocked by Firefox when using ZAP proxy? I was looking in Burp Suite where I could generate its CA for Firefox. I could not see it. I went to Burp ...
3
votes
1answer
316 views

How do I know that the request and response is using encryption protocols in burp suite?

I know these things can easily be done on wireshark, tshark, etc but is it possible to know that the request I forwarded and the response I received is using protocols such as TLS, TLSv1.2, TCP, HTTP, ...
3
votes
2answers
2k views

Reflected XSS only works through Burp Repeater because of URL encoding

I am able to get reflected XSS through burp repeater using a GET request. I then click on show response in browser and I am able to get an XSS alert. But when I manually go to the URL in my browser ...
3
votes
1answer
4k views

Optimal way to capture HTTP(S) traffic on proxy-unaware iOS applications

I am trying to capture HTTP(S) traffic from a proxy-unaware Xamarin iOS application. The current tools I have available is a Mac with a Linux Mint VM, Xcode and iOS developer tools, Burp Suite ...
3
votes
2answers
4k views

how to scan a web application that uses Captcha

I have a web application I am doing a security assessment on and it uses captcha for both the login and for certain operations inside the app. The interesting thing is that this particular app ...
3
votes
3answers
3k views

Using Tor from behind a Proxy (like Burp Suite)

I am interested in exploring a bit of the darknet, and I was wondering about the feasibility of running a Tor exit node from behind a local proxy like Burp Suite so that I could ID the destination ...
3
votes
1answer
413 views

How URL Encoding Works?

I am learning about web security but very confused about URL Encoding, it will be big help if anyone can help. On PortSwigger, I learned that url "http://127.0.0.1/admin" can be used as "http://127.0....
3
votes
1answer
2k views

How to MiTM insert an iframe using burp or another tool?

So, I am trying to obtain a cookie without the secure flag enabled over HTTPS. After reading about it, I came across an answer: You visit https://secure.example.com/ which drops a cookie on your ...
3
votes
2answers
2k views

Not able to intercept traffic from nike.com login request

I'm using BurpSuite to intercept the HTTP/HTTPS requests sent when logging in on https://www.nike.com/. I'm trying to achieve this with the following step: Opening BurpSuite and Firefox Turning on ...
3
votes
1answer
161 views

Is there a way to find out what information website queries about us? [closed]

What tool or software should I look for to find out what "fingerprinting" data a website is tracking? Like, I want to know, if website looks for a cache and/or fonts installed in system, or Canval, ...
3
votes
1answer
998 views

Burp proxy between non proxy aware device

I want to intercept traffic between a Ethernet connected device, which is not proxy aware and modify/inject javascript. Conventionally when testing webapps I would use burp. Can burp sit on my ...
3
votes
1answer
703 views

Burp suite interception bypass

I am trying to intercept application layer traffic using network level attacks. In particular, I have stumbled across this interesting article here. Link Briefly, it uses ARP poisoning to make ...
3
votes
1answer
8k views

Is is possible to intercept Guest VM traffic on the host machine's Burpsuite

I'm running Kali on Windows 7 via VMWare, and would like to be able to access private network websites, which i can't seem to be able to do. So I tried to forward the system traffic to the host ...
3
votes
1answer
1k views

Prevent external script from loading using Burp

I am using free edition of Burp Suite to analyze some requests. Suppose, website is https://www.example.com. Now, there is a javascript file in https://www.example.com/templates/scripts/xyz.js. I ...
3
votes
1answer
475 views

SQLMap on a seqential form

There is a certain form that gets posted over POST. The form has some form elements. I am doing a pen-test on the application that has this form. The form values are being stored in a certain database....
3
votes
0answers
224 views

Pentest website available through per app VPN

I am trying to intercept web traffic with burp from mobile devices (Android and iPhone) that are enrolled in an MDM solution (MobileIron). There is one specific website I want to proxy, that is ...

1
2 3 4 5