-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Burp Suite Cookbook
By :

HTTP requests can include methods beyond GET
and POST
. As a penetration tester, it is important to determine which other HTTP verbs (that is, methods) the web server allows. Support for other verbs may disclose sensitive information (for example, TRACE
) or allow for a dangerous invocation of application code (for example, DELETE
). Let’s see how Burp Suite can help test for HTTP verb tampering.
Using Altoro Mutual (https://demo.testfire.net), let’s determine whether the application has a POST
request we can manipulate into using a GET
instead. If possible, the GET
request will expose sensitive data within the query string. We will login first, then map the application to look for something interesting like a money movement transaction.
Figure 8.12 – Altoro Mutual landing page
You are brought...
Change the font size
Change margin width
Change background colour