27
votes
Accepted
Burpsuite accidental defacement, should I be concerned?
Number one rule of penetration testing: don't do it on things that don't belong to you. Yes, it is merely a spider. However, people think wget is a scary hacker tool and the US govt. actually used ...
- 4,727
19
votes
How to configure Burp Suite for localhost application
If none of these solutions work for you, like they didn't work for me, you could try to change value network.proxy.allow_hijacking_localhost to true (using firefox v 67.0.1 64-bit).
Open new tab, ...
- 319
14
votes
Accepted
What are the differences between Burp and OWASP ZAP?
It is true that both tools are in the same space. Burp is a commercial closed source tool (which can be extended) developed by a commercial company while ZAP is a free open source tool developed by ...
- 1,490
11
votes
Accepted
How to configure Burp Suite for localhost application
In Burp go to Proxy / Options / Proxy listeners, and confirm the Running box is ticked.
In proxy tab make sure intercept is turned off.
Make sure the proxy in burp listener is 127.0.0.1:6666.
...
- 1,303
10
votes
Accepted
Strange response body in burp suite
The response of the server reply is Brotli encoded:
Content-Encoding: br
I think that the Burp Suite doesn't decode this, so you're seeing the compressed version of your response.
For more ...
- 596
9
votes
Accepted
Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1
Did you go through these procedures to get JustTrustMe to bypass the cert pinning -- http://www.welivesecurity.com/2016/09/08/avoid-certificate-pinning-latest-versions-android/ -- ?
If you are just ...
- 19k
8
votes
Proxying MetaSploit through BurpSuite
Use the PROXIES environment variable (while in msfconsole) :
set PROXIES HTTP:127.0.0.1:8080
Or run Metalsploit with proxychains (config at /etc/proxychains.conf) http://proxychains.sourceforge.net
...
- 721
7
votes
How is HSTS handled on subdomains?
With HSTS, the browser will automatically convert HTTP links to HTTPS links. However, to prevent mistakes and abuse, browsers will only accept the HSTS header on a secured page.
As it relates to your ...
- 1,591
7
votes
Accepted
In what situations can element.setAttribute allow XSS?
setAttribute() is safe in that it does nothing more than setting the attribute's value. Even by using special characters in the string you cannot inject an additional attribute (as you attempted in ...
- 44.6k
7
votes
Accepted
Web App Pentesting: When enumerating website directories and files, how to tell if HTTP 200 is a valid page, or a failure page?
Web Applications and HTTP Status Codes
If it's returning 200 on both an unauthorized page (302 Redirects to 200 login page), and an authorized page (discovered authorized page), there are some things ...
- 22.6k
7
votes
Accepted
Can't Download Burp's CA Certificate from http://burp
These are your options:
http://burp - it failed for you for some reason
http://localhost:8080/ - or your burp proxy address and port
Proxy > Options > Import / Export CA Certificate > Export in your ...
- 1,840
7
votes
Accepted
Why does the file "shell.php.jpg" can execute as a php file but "shell.jpg" cannot?
shell.php.jpg should be treated as a .jpg file
You're exploring DVWA, so not every should be means is. If I had to guess, the upload script properly checks the extension of the file and allows it, ...
- 1,759
6
votes
vuln Cross-origin resource sharing: arbitrary origin trusted
https://xrmtfgxgjkzw.com is just an example generated by Burp. What it is in fact saying is that any website on the internet that the user is visiting can grab content from your site (possibly private ...
- 34k
6
votes
Accepted
Intercepting Android app traffic with Burp
First thing to remember is that Burp is a HTTP(S) proxy. It doesn't do anything about any data which isn't HTTP(S) (OK, except websockets). Android apps, on the other hand, can use any protocol they ...
- 27.4k
6
votes
Password shows as plaintext via burp suite interception for HTTPS request, is it an issue?
It's not a vulnerability.
Since the page transmits the password via HTTPS, it's encrypted before being sent on the network.
You allowed Burp to decrypt any encrypted traffic by adding their ...
- 14.7k
6
votes
Accepted
Preventing a Burp and Intercept
You may want to ask the reporter to explain what they think the security implications are.
Tricking the browser into showing a successful login via a locally forged API response does no harm unless ...
- 44.6k
6
votes
Accepted
How to intercept and replace request URL through Burp Proxy?
There is a sample extension to do this. Here is the description:
This extension demonstrates how to redirect outgoing HTTP requests from one host to another. This task might arise, for example, if ...
- 477
6
votes
Accepted
Burpsuite: just passthrough firefox detect portal
Disable Captive portal from firefox as seen in this link.
In order to do that open a new tab and type about:config, then search for network.captive-portal-service.enabled and set it as false then you ...
6
votes
Mutual TLS and Cert Pinning solving the same problem?
While mutual TLS and certificate pinning are intended for different problems they can be used to solve the specific problem of detecting active MITM too. Only, with mutual TLS it is the server which ...
- 198k
5
votes
How to configure Burp Suite for localhost application
Try adding a '.' after "localhost". This should solve your problem.
eg.
http://localhost.:8080/WebGoat/
This will force the localhost to use the same proxy settings as one would with an internet ...
5
votes
Accepted
How is HSTS handled on subdomains?
Q: Why did HSTS allow me to override?
A: HSTS is A TOFU (Trust-on-first-use) mechanism. And that means: if you're intercepted that first time, you're screwed.
And since (as Austin pointed out) the ...
- 18k
5
votes
Pentesting web applications with unique strings in URL
Burp supports Macros and Session Handling Rules that are designed to cope with this kind of situation. For example, you can configure a macro that fetches a fresh token, and a rule that updates the ...
- 477
5
votes
Accepted
How is intercepting my own HTTPS traffic possible?
Say you want to access SomeService's homepage through an HTTPS proxy. You start by making a connection between you and your proxy. Then your proxy makes a connection between itself and SomeService. ...
- 186
5
votes
HTML payloads work on burp but not on browser
When using Burp, you are injecting the code directly to the server without the browser-side javascript or tools.
When you enter the payload on the browser, it is processed by the browser-side ...
- 128k
5
votes
Accepted
How does Burp Suite evaluates this request as high severity with the issue "user input evaluated as code"?
The automated scan result is showing a potentially exploitable issue. Like every other automated scan result, you would have to perform a false positive analysis.
The easiest way to analyze this ...
- 7,417
5
votes
Burp Proxy vs MITM
The purpose of HTTP interception proxies is not to MitM requests of another user, and does not represent such attacks like you have stated. Instead, the purpose is to modify/craft requests in ...
- 12.7k
4
votes
How do I verify that my CSRF fix is successful using Burp?
For any CSRF issue, the general demonstration of prevention is showing that repeating the same request with the same preventative token, or with no preventative token, doesn't result in any data on ...
- 27.4k
4
votes
Accepted
Where is the BurpSuite CA HTTPS certificate located?
Two ways to get the CA cert -
1) Make sure your browser is pointing to the Burp proxy Interface Url and Port and navigate to http://burp and click on "CA Certificate" on the top right. In your ...
- 553
4
votes
Accepted
Configure Firefox the use Burp proxy
You have probably configured firefox correct, but you have intercept on, in the proxy-intercept tab turn of interception or forward/drop the request.
- 56
4
votes
Check for insecure CORS settings with cURL
You should only specify the origin header in your request. The application will respond with the Access-Control-* headers. Try only specifying the origin header and see what the result looks like.
...
- 290
Only top scored, non community-wiki answers of a minimum length are eligible