✍ Scribed by Dr. Sunny Wear
No coin nor oath required. For personal study only.
Find and fix security vulnerabilities in your web applications with Burp Suite
With its many features, easy-to-use interface, and fl exibility, Burp Suite is the top choice for professionals looking to strengthen web application and API security.
This book off ers solutions to challenges related to identifying, testing, and exploiting vulnerabilities in web applications and APIs. It provides guidance on identifying security weaknesses in diverse environments by using diff erent test cases. Once you’ve learned how to confi gure Burp Suite, the book will demonstrate the eff ective utilization of its tools, such as Live tasks, Scanner, Intruder, Repeater, and Decoder, enabling you to evaluate the security vulnerability of target applications. Additionally, you’ll explore various Burp extensions and the latest features of Burp Suite, including DOM Invader.
By the end of this book, you’ll have acquired the skills needed to confi dently use Burp Suite to conduct comprehensive security assessments of web applications and APIs.
If you are a beginner- or intermediate-level web security enthusiast, penetration tester, or security consultant preparing to test the security posture of your applications and APIs, this is the book for you.
Cover
Title Page
Copyright
Dedication
Contributors
Table of Contents
Preface
Chapter 1: Getting Started with Burp Suite
Downloading Burp Suite (Community and Professional editions)
Getting ready
How to do it...
Setting up a web app pentesting lab
Getting ready
How to do it...
How it works…
Creating a PortSwigger account to access Web Security Academy
Getting ready
How to do it…
Starting Burp Suite at a command line or as an executable
How to do it...
How it works...
Listening for HTTP traffic using Burp
Getting ready
How to do it...
How it works...
There’s more…
Chapter 2: Getting to Know the Burp Suite of Tools
Technical requirements
Setting the Target Site Map
Getting ready
How to do it...
How it works...
Understanding the message editor
Getting ready
How to do it...
Repeating with Repeater
Getting ready
How to do it...
Decoding with Decoder
Getting ready
How to do it...
There’s more...
Intruding with Intruder
Getting ready
How to do it...
Chapter 3: Configuring, Crawling, Auditing, and Reporting with Burp
Technical requirements
Establishing trust over HTTPS
Getting ready
How to do it...
There’s more...
Setting project configurations
How to do it…
Setting user configurations
How to do it…
How it works…
There’s more...
Crawling target sites
Getting ready
How to do it...
Creating a custom scan script
Getting ready
How to do it...
There’s more...
Reporting issues
Getting ready
How to do it...
Chapter 4: Assessing Authentication Schemes
Technical requirements
Testing for account enumeration and guessable accounts
Getting ready
How to do it...
Testing for weak lockout mechanisms
Getting ready
How to do it...
Testing for bypassing authentication schemes
Getting ready
How to do it...
How it works…
Testing for browser cache weaknesses
Getting ready
How to do it...
How it works…
Testing the account provisioning process via the REST API
Getting ready
How to do it...
How it works…
Chapter 5: Assessing Authorization Checks
Technical requirements
Testing for directory traversal
Getting ready
How to do it...
How it works...
Testing for LFI
Getting ready
How to do it...
How it works...
Testing for RFI
Getting ready
How to do it...
How it works...
Testing for privilege escalation
Getting ready
How to do it...
How it works...
Testing for IDOR
Getting ready
How to do it...
How it works...
Chapter 6: Assessing Session Management Mechanisms
Technical requirements
Testing session token strength using Sequencer
Getting ready
How to do it...
How it works...
Testing for cookie attributes
Getting ready
How to do it...
How it works...
Testing for session fixation
Getting ready
How to do it...
How it works...
Testing for exposed session variables
Getting ready
How to do it...
How it works...
Testing for cross-site request forgery
Getting ready
How to do it...
How it works...
Chapter 7: Assessing Business Logic
Technical requirements
Testing business logic data validation
Getting ready
How to do it...
How it works...
Unrestricted file upload – bypassing weak validation
Getting ready
How to do it...
How it works...
Performing process-timing attacks
Getting ready
How to do it...
How it works...
There’s more...
Testing for the circumvention of workflows
Getting ready
How to do it...
How it works...
Uploading malicious files – polyglots
Getting ready
How to do it...
How it works...
There’s more...
Chapter 8: Evaluating Input Validation Checks
Technical requirements
Testing for reflected cross-site scripting
Getting ready
How to do it...
How it works...
Testing for stored cross-site scripting
Getting ready
How to do it...
How it works...
Testing for HTTP verb tampering
Getting ready
How to do it...
How it works...
Testing for HTTP parameter pollution
Getting ready
How to do it...
How it works...
Testing for SQL injection
Getting ready
How to do it...
How it works...
There’s more...
Testing for command injection
Getting ready
How to do it...
How it works...
Chapter 9: Attacking the Client
Technical requirements
Testing for clickjacking
Getting ready
How to do it...
How it works...
Testing for DOM-based cross-site scripting
Getting ready
How to do it...
How it works...
Leveraging DOM Invader for testing DOM XSS
Getting ready
How to do it...
How it works...
There’s more...
Testing for JavaScript execution
Getting ready
How to do it...
How it works...
Testing for HTML injection
Getting ready
How to do it...
How it works...
Testing for client-side resource manipulation
Getting ready
How to do it...
How it works...
Chapter 10: Working with Burp Suite Macros and Extensions
Technical requirements
Creating session-handling macros
Getting ready
How to do it...
How it works...
Getting caught in the cookie jar
Getting ready
How to do it...
How it works...
Adding great pentester plugins
Getting ready
How to do it...
How it works...
Creating new issues via the Add & Track Custom Issues extension
Getting ready
How to do it...
How it works...
See also
Working with the Active Scan++ extension
Getting ready
How to do it...
How it works...
Using Burp Suite extensions for bug bounties
Getting ready
How to do it...
How it works...
Chapter 11: Implementing Advanced Topic Attacks
Technical requirements
Performing XXE attacks
Getting ready
How to do it...
How it works...
Working with JWTs
Getting ready
How to do it...
How it works...
Using Burp Suite Collaborator to determine SSRF
Getting ready
How to do it...
How it works...
See also
Testing CORS
Getting ready
How to do it...
How it works...
See also
Performing Java deserialization attacks
Getting ready
How to do it...
How it works...
Hacking GraphQL using Burp Suite
Getting ready
How to do it...
How it works...
There’s more...
Index
About Packt
Other Books You May Enjoy
📜 SIMILAR VOLUMES
Burp Suite is an immensely powerful and popular tool for web application security testing. This book provides a collection of recipes that address vulnerabilities in web applications and APIs.
Get hands-on experience in using Burp Suite to execute attacks and perform web assessments Key Features Explore the tools in Burp Suite to meet your web infrastructure security demands Configure Burp to fine-tune the suite of tools specific to the target Use Burp extensions to assist with different
Practical recipes to help you master web penetration testing with Burp Suite
The purpose of the Burp Suite Cookbook is to provide web application penetration testers with hands-on examples of how to use Burp Suite to perform web assessments. The book gives detailed screenshots demonstrating how to perform various attacks in Burp including Cross-site Scripting (XSS), SQL Inje
The purpose of the Burp Suite Cookbook is to provide web application penetration testers with hands-on examples of how to use Burp Suite to perform web assessments. The book gives detailed screenshots demonstrating how to perform various attacks in Burp including Cross-site Scripting (XSS), SQL Inje
The purpose of the Burp Suite Cookbook is to provide web application penetration testers with hands-on examples of how to use Burp Suite to perform web assessments. The book gives detailed screenshots demonstrating how to perform various attacks in Burp including Cross-site Scripting (XSS), SQL Inje