Now we've introduced some skills along the way and some tools like Zapp proxy
or Zapp proxy and kind of just started getting into the basics over over some
simple evasion tactics but didn't really address them directly.
Well, in this skill, we're going to be introducing FURP suite, which takes a
lot of the things that we've learned up to this point in the web server and web
application assessment for vulnerabilities and has something for us to put pen
to paper.
And get a better understanding of things like what a proxy is and how tools
like burp suite allow us to be able to provide evasion tactics inside of a pen
test that we totally have permission for.
Now we're going to be using the same lab that we did in the last skill I have
it linked below and it's applied to the playground lab listings for the course
overall.
So let's go ahead and jump on over to our side screen real quick and you can
see here that I have the Kelly box opened up and that's the first one that we
're going to be jumping into as we begin to open up burp suite and kind of go
over some of the basics real quick.
Now as I begin to open this up burp suite is a tool that's already installed
inside of Kelly distributions normally.
So if you don't have it, it's a simplistic pseudo apt install burp suite and
you can get to it one of two ways.
First one is through the actual toolbar itself and you can see burp suite or
you can actually go into the terminal and pseudo burp suite.
You would want to run this with admin permissions and when you do you're going
to come up to this particular screen right here as I begin to zoom in for us to
so we can see it more clearly.
That we have a couple of different options here.
Now you can do this as a temporary project or a new project one that you can
continue on at a later date.
The reason I point this out specifically before we start getting into the
actual details of burp suite is burp suite as a individual use is free.
And that's also why it's included in normal Kelly distributions.
That being said though, you have to pay for an upgrade and that way you'll be
able to use features like new projects and continue to use those projects later
on.
So everything that we're doing right now is just a normal community edition bur
p suite.
And as you can see right there in orange disk based projects are only supported
in the burp suite professional.
So please keep that mind that once you open this up and you begin to run a
project that it needs to be from start to finish as we continue on throughout
the skill.
And if you're doing your own pen testing at home, that being said, we're going
to go ahead and click next and you can see here that we have either defaults or
load from a configuration file.
Let me zoom in for you real quick and you can even skip the screen of the
future if you want.
But we're not really going to go into config files just yet.
We may do so later in the course.
We want to get a better familiarity with burp suite as a tool for an
introduction right now and use the defaults.
Now there are a lot of tools and options that are available to us in the
default alone to where we may never even have to use a config file.
But when we talk about actual configuration files from burp suites, we're
talking about proxy settings.
We're talking about different types of fuzzing settings and some different
things that we'll be getting into later.
So if you want to have, let's say, a package ready to deliver to crawl a
website from burp suite and you want particular settings saved and that's how
you'd like to do things.
You can't save it to a config file and load from here at a later time if you
want.
That is one feature that is available to us of many in the community edition.
and essentially from there we just go into start burp suite.