36

Burp Suite in proxy mode is able to decrypt HTTPS traffic of any systems which trust it. It does this by generating an own certificate and use this cert to register itself as a certificate authority on the system it is installed on. When it then proxies a request to a HTTPS webserver, it does the HTTPS handshake itself, decrypts the traffic, issues a ...


27

Number one rule of penetration testing: don't do it on things that don't belong to you. Yes, it is merely a spider. However, people think wget is a scary hacker tool and the US govt. actually used that in a case. I appreciate that you rectified your mistake, and I think that reflects well on you. You have a few options here, depending on your moral beliefs: ...


20

There are a lot of free tools out there. You may not find a free tool with the exact same functionality as Burp, but you could use several tools to compensate for the limitations of Burp's free version. use Owasp ZAP or Webscarab for their proxy functionality. use Nikto and W3AF to scan web applications. use SQLMap to exploit SQL injections vulnerabilities. ...


15

In this case the first \ is escaping an escape to provide attacker with a un-escaped double-quote: var x="\\";alert('XSS');//" This is assuming the target application has a broken escape routine.


10

The response of the server reply is Brotli encoded: Content-Encoding: br I think that the Burp Suite doesn't decode this, so you're seeing the compressed version of your response. For more information about Brotli you can look here. Update: Until the Burp Suite supports Brotli, you can override the Accept-Encoding-Header as a workaround. Go to Proxy -&...


8

Burp can use an upstream proxy server. You would set up your browser to use your burp instance (usually localhost:8080), and in Burp's options, you can set your company's proxy server (say: proxy.company.com:8080). All traffic will pass through your company's server, after it has been handled using Burp. To help auditing both internal (intranet) and ...


8

Absolutely absolutely pick up the Web Application Hackers Handbook by Portswigger (author of Burp), which is written as both an introduction to the concepts relevant to Web App reversing / hacking, but also as a step-by-step guide for applying those concepts with Burp Suite. Note that the Second Edition is now available.


8

Burp is an intercepting Proxy, which lets you inspect and modify traffic between your browser and the target application. Burp is actually serving it's own certificate so that you can see what's inside the request. Normally you will have accepted a security warning for a certificate issued by Portswigger, this is the certificate generate by Burp. If you ...


7

First question I'd ask is do you have the Pro (paid for) version of Burp Suite? Scanner functionality isn't available in the free version so that would explain the problem you're seeing.


7

With HSTS, the browser will automatically convert HTTP links to HTTPS links. However, to prevent mistakes and abuse, browsers will only accept the HSTS header on a secured page. As it relates to your case, HSTS will not allow users to manually accept a self-signed certificate once HSTS has been enabled (which can only be done from a secure page). That ...


6

The purpose of the string is to test if JavaScript injection is possible. It will not do harm itself, only show an alert box with the message "XSS" which would mean that you successfully injected the website with some JavaScript. Then, an attacker could inject any JS to perform an XSS attack.


6

In short, you don't need SOFTWARE, you need KNOWLEDGE. Seek that first, then the tools can help.


6

BurpSuite will not intercept server responses by default and display them to you. To enable this functionality go to: Proxy -> Options -> Intercept Server Responses And make sure to check the box next to Intercept responses based on the following rules Then either select one of the displayed rules or add one like the highlighted one below: Also make ...


6

Web Applications and HTTP Status Codes If it's returning 200 on both an unauthorized page (302 Redirects to 200 login page), and an authorized page (discovered authorized page), there are some things you can do: You can look for what happens on a successful login. Make a fake account, log in. See what does not get included on the real page, and what doesn'...


6

There is a sample extension to do this. Here is the description: This extension demonstrates how to redirect outgoing HTTP requests from one host to another. This task might arise, for example, if you have mapped out an application which then moves to a different staging URL. By simply redirecting traffic to the new hostname, you can continue to drive ...


6

shell.php.jpg should be treated as a .jpg file You're exploring DVWA, so not every should be means is. If I had to guess, the upload script properly checks the extension of the file and allows it, but the webserver doesn't check it the same way and allows execution. You can learn more by exploring web server's (nginx or apache) config files, look for a ...


5

BurpSuite is only used to send HTTP requests in an automated way. There is no way to tell if a request is coming from BurpSuite or not. (Just have a look at your request header or body). You might be able to detect such a robot though. Tools such as BurpSuite use a scanner, and you can trap them by making them follow an invisible link on your website. Tools ...


5

Q: Why did HSTS allow me to override? A: HSTS is A TOFU (Trust-on-first-use) mechanism. And that means: if you're intercepted that first time, you're screwed. And since (as Austin pointed out) the includeSubDomains header is incorrect on the parent domain your user agent knew nothing about the subdomains. And the TLS setup is in a lower layer than the HTTP ...


5

setAttribute() is safe in that it does nothing more than setting the attribute's value. Even by using special characters in the string you cannot inject an additional attribute (as you attempted in your third snippet), let alone escape the HTML tag. Some attributes are dangerous for some elements. As you demonstrated, on* attributes are vulnerable because ...


5

https://xrmtfgxgjkzw.com is just an example generated by Burp. What it is in fact saying is that any website on the internet that the user is visiting can grab content from your site (possibly private to a user) if they are also logged into it. Scenario is as follows: Bob logs into your site, example.com. Bob gets an email from the attacker saying he can ...


5

Did you go through these procedures to get JustTrustMe to bypass the cert pinning -- http://www.welivesecurity.com/2016/09/08/avoid-certificate-pinning-latest-versions-android/ -- ? If you are just looking to intercept WebViews, then the Frida extension, appmon (which allows for API interception), using these techniques will work well -- https://youtu.be/...


5

First thing to remember is that Burp is a HTTP(S) proxy. It doesn't do anything about any data which isn't HTTP(S) (OK, except websockets). Android apps, on the other hand, can use any protocol they want. Lots do use HTTP(S), just because it suits the type of data they're sending, but it's not actually required. Where an app isn't using HTTP(S), that ...


5

Burp supports Macros and Session Handling Rules that are designed to cope with this kind of situation. For example, you can configure a macro that fetches a fresh token, and a rule that updates the current request. This can be used with all Burp tools, including Intruder and Scanner. There's some more information here. The built-in rules cannot update ...


5

You may want to ask the reporter to explain what they think the security implications are. Tricking the browser into showing a successful login via a locally forged API response does no harm unless the user can use that to actually bypass authentication or access confidential information. An attack would have to trick the server into assuming the ...


5

When using Burp, you are injecting the code directly to the server without the browser-side javascript or tools. When you enter the payload on the browser, it is processed by the browser-side javascript and tools. So, what you are seeing is the potential that the browser is sanitising the input before sending to the server. That's why tools like Burp are ...


5

This depends on the tool you are using within Burp: Site map - HTTP and HTTPS URLs are shown separately in the tree Proxy - There is an SSL tick box in the table Repeater - The target URL will show HTTP or HTTPS Logger++ There is an SSL tick box similar to Proxy Burp does not show the SSL cipher suite used. You can use the SSL Scanner extension in the BApp ...


4

Appscan has the "show in browser" feature that opens Appscan's special "worst of all worlds" browser for the given vulnerability. If it isn't a false positive, this browser should execute the Javascript. I have found it a pretty reliable way to check for false positives. For all other testing, I've found that Firefox is the least protected from XSS, so I ...


4

In your question, you mention that the app displays the text of the captcha right under it. If you mean that the correct answer to the captcha challenge is displayed to the user as text in addition to its display in an image, then it should be a simple matter to script an automated scan. Your script would be able to complete the login process by reading the ...


4

Burp has some relatively complex options available for session handling but in the basic case, the scanner will use sessions from burps "cookie jar", so as long as it knows about a valid session ID it'll use it. If you invalidate your sessions while the scanner is running (for example by using logout functionality) then the scanner will likely stop working ...


4

So how can I get Java to ignore the certificate pinning? To get around certificate/public key pinning you must usually make changes to the application itself since the pinning is done there with an application specific trust manager. That means it does not work to just add your CA as trusted to the system wide CA store. For a recent write-up of how this ...


Only top voted, non community-wiki answers of a minimum length are eligible