So let's say that somebody's trying to log into this website and we have our
interceptor going.
So we're going to type in a username of B and a password of bug. There we go.
And then we're going
to hit enter and it'll take us back over to the burp suite. There we go. Now
there's a couple
things that we can do here as well. This isn't just interceptor packets and
being able to read
the username of password. Although that is kind of cool to do. We're going to
go down here and go
scroll down a little bit and on the last line pop out and zoom in for us real
quick.
You see here that we have the log in B and password of bug. Again plaintext but
I just want to make
a point here. We can actually at this point move over to where the password
says bug.
Back that up and type in QQQ just as an example. And then I can go for the
packet.
If my mouse will play with me. Okay so the package is been forwarded. Let's tab
over real quick.
And we're back here again at the log end screen. That didn't make any sense as
I'm not sure why.
Let's scroll down a little bit and see if we can narrow up invalid credentials
or user not active
or activated. Weird right. Well what we did was is we just modified the post
request going to
that actual website. Let's pop back over to burpsweet real quick and go back
into our
Target. And right here where you could see where the check marks are those are
the ones that we've
modified and forwarded on. We captured the packet. We got to actually modify
the thing and then
send it on. And we did get all packets associated with coming back from the
server to the client
and picked it up in burpsweet as well. Now if there's an invalid page that was
picked up as
along with that it would have added itself to the actual site map. And you can
see here that it
kept a collection of all the attempts that were trying against log in dot PHP.
So we're starting
to get into the enter of the interception and understanding of what's actually
going on. Well
let's take a little bit a step further. Let's go back to our browser here real
quick.
So once we send our login request again it should pop us back on over to burps
weet right here.
We'll go back into the proxy and see what else we can do. Now you'll notice
here that we have a
few options and one of them is send to intruder which is control I and that
allows us to be able
to go through and potentially open up more options for packet manipulation.
Inside of here is where
we start to get to the nuts of bolts of what burpsweet is about and that is
where we're able to start
doing some attacks. Now we're not going to get into the attacks just yet we
just wanted to get
into the basics of burpsweet and understanding that we can intercept the
packets manipulate them
send them on their way and open ourselves up to being able to do more and
attack the actual test
box that we have within our lab environment as well. This is just to point out
that this is an
option for you so that way you can start playing along at home if you want to
start jumping ahead
and getting familiar with burpsweet. But we will come back to this in a future
time.
For right now we're going to start moving along and understanding those types
of packets that we
were manipulating and start getting ready for our challenge.