Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Advanced Search Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Book Overview & Buying Burp Suite Cookbook
  • Table Of Contents Toc
  • Feedback & Rating feedback
Burp Suite Cookbook

Burp Suite Cookbook

By : Dr. Sunny Wear
5 (7)
Buy this Book
close
close
Burp Suite Cookbook

Burp Suite Cookbook

5 (7)
By: Dr. Sunny Wear
Buy this Book

Overview of this book

With its many features, easy-to-use interface, and flexibility, Burp Suite is the top choice for professionals looking to strengthen web application and API security. This book offers solutions to challenges related to identifying, testing, and exploiting vulnerabilities in web applications and APIs. It provides guidance on identifying security weaknesses in diverse environments by using different test cases. Once you’ve learned how to configure Burp Suite, the book will demonstrate the effective utilization of its tools, such as Live tasks, Scanner, Intruder, Repeater, and Decoder, enabling you to evaluate the security vulnerability of target applications. Additionally, you’ll explore various Burp extensions and the latest features of Burp Suite, including DOM Invader. By the end of this book, you’ll have acquired the skills needed to confidently use Burp Suite to conduct comprehensive security assessments of web applications and APIs.
Table of Contents (14 chapters)
close
close
close
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Conventions used
Sections
Get in touch
Share your thoughts
Download a free PDF copy of this book
Free Chapter
1
Chapter 1: Getting Started with Burp Suite
chevron up
Chapter 1: Getting Started with Burp Suite
Downloading Burp Suite (Community and Professional editions)
Setting up a web app pentesting lab
Creating a PortSwigger account to access Web Security Academy
Starting Burp Suite at a command line or as an executable
Listening for HTTP traffic using Burp
2
Chapter 2: Getting to Know the Burp Suite of Tools
Chapter 2: Getting to Know the Burp Suite of Tools
Technical requirements
Setting the Target Site Map
Understanding the message editor
Repeating with Repeater
Decoding with Decoder
Intruding with Intruder
3
Chapter 3: Configuring, Crawling, Auditing, and Reporting with Burp
Chapter 3: Configuring, Crawling, Auditing, and Reporting with Burp
Technical requirements
Establishing trust over HTTPS
Setting project configurations
Setting user configurations
Crawling target sites
Creating a custom scan script
Reporting issues
4
Chapter 4: Assessing Authentication Schemes
Chapter 4: Assessing Authentication Schemes
Technical requirements
Testing for account enumeration and guessable accounts
Testing for weak lockout mechanisms
Testing for bypassing authentication schemes
Testing for browser cache weaknesses
Testing the account provisioning process via the REST API
5
Chapter 5: Assessing Authorization Checks
Chapter 5: Assessing Authorization Checks
Technical requirements
Testing for directory traversal
Testing for LFI
Testing for RFI
Testing for privilege escalation
Testing for IDOR
6
Chapter 6: Assessing Session Management Mechanisms
Chapter 6: Assessing Session Management Mechanisms
Technical requirements
Testing session token strength using Sequencer
Testing for cookie attributes
Testing for session fixation
Testing for exposed session variables
Testing for cross-site request forgery
7
Chapter 7: Assessing Business Logic
Chapter 7: Assessing Business Logic
Technical requirements
Testing business logic data validation
Unrestricted file upload – bypassing weak validation
Performing process-timing attacks
Testing for the circumvention of workflows
Uploading malicious files – polyglots
8
Chapter 8: Evaluating Input Validation Checks
Chapter 8: Evaluating Input Validation Checks
Technical requirements
Testing for reflected cross-site scripting
Testing for stored cross-site scripting
Testing for HTTP verb tampering
Testing for HTTP parameter pollution
Testing for SQL injection
Testing for command injection
9
Chapter 9: Attacking the Client
Chapter 9: Attacking the Client
Technical requirements
Testing for clickjacking
Testing for DOM-based cross-site scripting
Leveraging DOM Invader for testing DOM XSS
Testing for JavaScript execution
Testing for HTML injection
Testing for client-side resource manipulation
10
Chapter 10: Working with Burp Suite Macros and Extensions
Chapter 10: Working with Burp Suite Macros and Extensions
Technical requirements
Creating session-handling macros
Getting caught in the cookie jar
Adding great pentester plugins
Creating new issues via the Add & Track Custom Issues extension
Working with the Active Scan++ extension
Using Burp Suite extensions for bug bounties
11
Chapter 11: Implementing Advanced Topic Attacks
Chapter 11: Implementing Advanced Topic Attacks
Technical requirements
Performing XXE attacks
Working with JWTs
Using Burp Suite Collaborator to determine SSRF
Testing CORS
Performing Java deserialization attacks
Hacking GraphQL using Burp Suite
12
Index
Index
Why subscribe?
13
Other Books You May Enjoy
Other Books You May Enjoy
Packt is searching for authors like you
Share your thoughts
Download a free PDF copy of this book

Getting Started with Burp Suite

This chapter provides the setup instructions necessary to proceed through the material in this book. Starting with downloading Burp, the details include the two main Burp editions available and their distinguishing characteristics.

To use Burp Suite, a penetration tester requires a target application. This chapter includes instructions on downloading and installing OWASP applications contained within a Virtual Machine (VM). Such applications will be used throughout this book as targeted vulnerable web applications.

This chapter includes instructions to configure the Burp Suite Proxy listener. This listener is required to capture all HTTP traffic flowing between your local browser and the target website. Default settings for the listener include an Internet Protocol (IP) address, 127.0.0.1, and a port number, 8080.

Finally, this chapter will conclude with the options for starting Burp Suite. This includes how to start Burp Suite at the command line, with an optional headless mode, and using the executable.

In this chapter, we will cover the following recipes:

  • Downloading Burp Suite (Community and Professional editions)
  • Setting up a web app pentesting lab
  • Creating a PortSwigger account to access Web Security Academy
  • Starting Burp Suite at a command line or as an executable
  • Listening for HTTP traffic using Burp
End of Section 1
Next Section
bookmark search playlist font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete

Confirmation

Modal Close icon
claim successful
Order Page Read Now

Buy this book with your credits?

Modal Close icon
Are you sure you want to buy this book with one of your credits?
Close
YES, BUY