Now that we know we can use Burp Suite in the real world and its applications
as a proxy for us to be able to conduct pen testing,
let's start taking a look at some of the tools and default setup.
Now, first and foremost, I'm doing something a little bit different with this
lab.
So when we go into proxy settings, you'll notice that the default port of 8080
is not being used.
It's 8181 in this lab.
That being said, here we are in the default dashboard of Burp Suite as it
starts up.
And I will be zooming in and out for us.
One of the first things that we need to do is go into our proxy settings and
make sure you'll be on the intercept screen first.
And go into our proxy settings to make sure that we are in fact running.
Now by running, I mean we should be able to see that the check mark is there
for running inside of our proxy settings.
So let's go ahead and exit out of that and you'll see here that intercept is
turned off and you'll also see an open browser.
I'm going to pop out zoom in for you real quick, that open browser.
There is a native function inside of Burp Suite so you don't have to configure
the proxy inside of your other browsers like we did earlier.
You could just open one up here and have everything tunnel through that.
So that's what we're going to do and hit that open browser.
And you could see that we had a version of chromium if you will inside of the
Kelly world open up for us.
Now when we do this, let me tab over real quick.
We're going to go also and turn our intercept on.
Remember this is all under the proxy tab up at the top.
When we turn on our proxy tab, we go ahead and go back to the browser and start
typing in web addresses.
And you'll see that inside of Burp Suite, we're starting to pick up traffic.
And we have the same forward function as we did earlier.
We can go down and go to for it all so that way all the traffic goes from the
browser to the rest of the web and back without having to stop and ask us for
permission first.
Why would we use something like this?
Well, we may want to stop the traffic and see if there's any kind of breakdown
inside the packet down at the bottom in the request that we can manipulate
later on.
Let's say we were doing our crawling in WGIT and we were using GoBuster to get
a directory browsing and we weren't getting the results that we truly intended.
Well, that being said, let's go to our test website here.
You can see here that we also have another issue with Burp Suite that might tip
off the user.
And that is an all SSL request have to go through Burp Suite as well.
So there's options later on that we'll discover that allow us to mimic those
SSL certs and allow that traffic to go back and forth.
But because it's going through a man in the middle, this right here interrupts
and does not let the SSL certificate be verified.
We can hit continue to site.
And we will get Google to come up eventually.
If we go back over to Burp Suite, we need to see if we can afford all the
request.
Go back over and it may take a second because we're not necessarily going to
Google, but while that's loading, we're going to go to bwap.test.
Now, once we're at bwap.test, we can just start clicking on tabs and you'll
notice that it takes us right back over to Burp Suite.
And that's because it's asking us to forward the packets over.
And when we tab back over, it takes us to that page.
Why?
Well, it's keeping track and making sure that we authenticate all the traffic
that's going through this.
Yes, there are rules we could set up to automatically send that traffic forward
, but we may want to take a deeper look at it later on.
So I'm going to browse around here for a second and let things build out and
show you what I'm building here momentarily.
Now that I've gone through and done a few click and it forwarded all those
packets, I can either go to HTTP history first, which is right up at the top
above intercept on.
And you can see all the different clicks that I've gone through to do and the
method to which HTTP did it.
This is generally a get, but you do see a post there.
Now that can be good and bad because later on, we'll see how to potentially
inject some stuff inside a post.
But if we go back up to the top and go into target, which is right to the left
of proxy, you can see here that it has built out a mapping
or a site map, if you will, of all the sites that we have been to through our
browser that's proxying through Burp Suite.
And if we do remember in previous skills, like the previous one in the one
before, when we were crawling the actual website, we were only getting a few
pages of PHP inside of our capture.
But would you take a look at this as we expand, Bwap.test, and now move in just
a little bit deeper, you could see here that we're actually seeing more and
more of the PHP pages that we were actually trying to get earlier and some of
the actual folders that were within the actual site as well.
In addition to that, I have one that's actually highlighted for us that I'm
going to zoom in for you real quick.
You can see here that under login.php, keep in mind, bwap.test is HTTP only.
But it did a post and you can even see the username and password that was sent
to be able to log into the website through the actual post method itself.
It's on the left, it's highlighted there, login equal B and password equal bug.
So you can actually sit down and monitor some sites and later on when we start
incorporating the SSL and TLS potentially be able to see login and passwords
going through that as well.
So now we're starting to understand why setting up tools like Burbsweet and
setting up that man in the middle attack as a pen tester can be critical for us
to be able to get more information and potentially mask our identity as we're
starting to go through and do reconnaissance on the network after we have our