In this article, we are going to see another powerful framework that is used widely in pen-testing. Burp suite is an integration of various tools put together to work in an effective manner to help the pen-tester in the entire testing process, from the mapping phase to identifying vulnerabilities and exploiting the same.hongkexy.com

In the figure above, we see the various features of this tool, like proxy, spider, intruder, repeater, sequencer, decoder and comparer. As we move ahead in the tutorial, we shall learn how to make use of them seamlessly.

Burp-Proxy

This lets you intercept the traffic between the browser and target
application. This option works like the man-in-the-middle attack vector.
Below I shall show you one of my favorite examples in demonstrating
this feature.

Here,
we are seeing a Wikipedia login form (dummyuser:dummypassword) and we
shall see how the intercept is put. Initially we need to switch the
intercept mode ON, in the suite. The FORWARD option allows you to send
the packets coming from the source IP to the destination IP. The DROP
option allows you to drop the packet if you feel it’s not a potential
packet that needs analysis.

In this figure, we see that the login credentials of en.wikipedia.org
are being captured. The point here to note is that Wikipedia uses HTTP
instead of HTTPs and thus, the login credentials are captured in clear
text.

The burp proxy listener is enabled on Port 8080 of the local host.
There are various options for intercept set-up, like request methods,
matching file extensions, and URL scope for the client requests. Other
options like request type, content types, and URL scope in the server
responses are available to be set-up based on the attack scenario.

I have used Mozilla Firefox here. The same holds for any other browser.

The following steps can be many from this phase. The capture can be
dropped, or sent to spider, sequencer, comparer etc. There is an option
of changing the request methods from GET to POST and so on.

Burp-site Map and Site Scope

In this section, we are seeing the Burp site maps and site scopes.
This section shows us the various sections of a particular domain. Here,
we can choose the scope of our security testing. We see a huge number
of sub domains when we hit on www.google.com. The figure shows the
site-map and site scope. We can also see the pages visited which are
darkened, and unvisited pages are grayed.

This particular instance in the screenshot shows the searches that
are done by the user. I have searched for “Security research”, and using
the key word finder, I have highlighted the word “security”.

The figure to the left shows the site-map of Google. Google is just
used here for a demo. The target web application can be anything under
analysis.

Burp Spider

The spider tool is used to get a complete list of URLs and parameters
for each site. The tool looks into each page that was manually visited
and goes through every link it finds in the testing scope. Make sure
when using spider tool that your proxy and interceptors are switched
off. The more links you manually visit, the better spider you are going
to get. It simply gives the spider a larger coverage area.

Setting up the spider is done using the options menu. The two main
things we need to set are the authentication and the thread count. The
authentication field can be set with a username and password
combination. The reason we set up this is because when the spider comes
across a login page, it can go through the authentication process in an
automated manner, giving more scope to spider the target.

Thread count is the number of concurrent threads that are being used.
For a local testing, this count can be high. A higher thread count
would imply faster processing but also a larger load. Occasional pop-ups
occur asking for changing the scope. Depending on the set up we can
choose either a yes or a no.

Once we are done spidering the target, we use the scanner. I am using
a free edition of the Burp suite, so the scanner is disabled in this.
The professional edition has fully functional scanners. The scanner is
used to make tests. There are two types of tests: active and passive.
Active tests send data and analyze the possibilities. Passive tests
examine all traffic and determine the vulnerabilities present in the
application. It’s left to the user’s discretion to choose the type of
tests that need to be done on the target.

Burp-Intruder

The intruder has 4 panels as seen in the figure, namely target, positions, payloads and options.

Target: This panel is used to specify the target
host (the URL), the port to use for the connection, and also it gives
options for using SSL encryption depending on our scenario. The figure
below shows the target panel.

Positions: This panel is very important in
automating attack strings on the target. There are various kinds of
attack vectors, such as sniper attack, battering ram attack, pitchfork
attack and cluster bomb.

On observing the figure, we see that the payload positions are
automatically highlighted with a “§” character. This happens when you
click on the auto button to the right. You can add markers and customize
too. A clear option is used to clear all the markers on the page.

A sniper attack is used as a single set of payload. Here, only one
value is replaced in the entire payload positions, one after the other.
Battering ram is also another form of single payload attack. This is
used when a single value is needed in the payload position. The
Battering ram works fine when the password quality rules, the policies
set are allegedly weak in nature. A lot of enumeration has to be gone
through before using this form of attack, since it works in a scenario
where, for example, the username and password both would have the same
values.

A pitchfork attack, as we are going to see, is used when we need a
multiple payload-set. A cluster bomb is another form of a multiple
payload attack vector. In a cluster bomb attack, there are two lists;
every word in the first list runs against every word in the second list.
It is effectively used when the target has a login form which has to be
breached.

In this section, I am going to demonstrate a SQLi attack on the demo
page of etopshop at the following URL:
http://www.etopshop.com/demo/pcstore/admin.asp

SQL injection testing using Burp-intruder

After capturing the page as described, I custom chose my payload
markers as Username fields and Password fields. From here, I deduced
that since the attack requires two parameters, I need a multiple payload
attack. I chose pitchfork attack vector from the dropdown menu. The
figure shows the options being set for the attack. I chose the preset
list for adding my SQL attack strings to be tried out at the target.

In the figure, we see that we can add, save the preset list of
payloads, etc. We have lot of options under the payload set. To mention a
few, we have character based, number based, random characters based,
brute force, dates, etc. As you can see, I have used the preset list.

The figure shows the process of SQL injection, once you click on
start-attack. The results tab shows the payloads being sent to the
target. The request tab shows the HTML source and how the payloads are
placed at our chosen markers.

Another tab of interest is the response tab. Here, we see that the
injection succeeded and we have been welcomed as the store manager when
we analyze the HTML source. To see the web page, we can even click on
render.

In the figure, we see the successful penetration of the web
application, using the famous SQL injection vulnerability. Similarly,
XSS attack vulnerabilities can be checked, which I shall leave it to the
intuition of the reader, on how to go about it.

Burp-Repeater

In this section, we shall see the Burp-repeater. This tool is
generally used to manually modify the HTTP requests and test the
responses given by the page. This can even lead to probing for
vulnerabilities on the web-page. Basically, this is used to play back
requests to the server.

Understanding XSS with Burp-Repeater

We shall use a vulnerable web application at:
http://www.steve.org.uk/Security/XSS/Tutorial/simple.html for
understanding and analyzing XSS (Cross site scripting) Vulnerability in a
webpage.

In the figure, I have highlighted the attack spot on the webpage,
which takes the input, and we will try probing for XSS vulnerabilities.
Now, we pass a script tag, the attack string I use is a very simple
JavaScript like:

<iframe src=”javascript:alert(‘Xss’)”;</iframe>

We see that the iframe code is injected into the source of the web
page. When checked on the browser to confirm, if there is a XSS bug
present in the application, we see that there is a reflected XSS
vulnerability on the target as shown in the figure.

Burp Sequencer

If we want to check for the extent of randomness in the session
tokens generated by the web application, this is a tailor made tool to
carry out such tests. Brute force attacks enumerate every possible
combination for gaining authentication to the web application. This
makes it a serious concern to have the high degree of randomness in the
session token IDs. Let’s start with sending a request which contains a
session token.

In this figure you can see the token request to the site Google.com.
The right side of the screen shot has the token start and token end
expressions. We can either specify an expression like “Google” or even
set the offset from where the token has to start. The same thing holds
at the token end panel, where we can set the delimiter, or a fixed
length for the capture to start. After fixing these parameters, we can
click START CAPTURE.

The start capture action panel looks like the screenshot above. It
sends requests to the target and gives a detailed analysis of the
randomness in the cookie tokens. We can pause/stop the analysis when we
wish to. I stopped the scan mid-way to see the results of the analysis
until the paused values. The screenshot below explains the results
better.

The scan components are as follows:

1. Overall result
2. Effective Entropy
3. Reliability
4. Sample size considered

Burp automatically analyses this aspect and generates this report in
this sequencer tool. Other analysis types are character level analysis,
which tells us the degree of confidence in the randomness of the sample
through a graphical display. Similarly, the bit-level analysis is the
analysis done at the bit level. You have the choice to pad characters in
the options panel and also to decode in base64 if needed.

Burp Decoder

This tool enables you to send a request to the decoder. Within the
decoder, we have multiple options to encode the request into various
formats like base64, URL, etc. There are also options to convert the
same to hashes like MD5, SHA-1, etc.

The above screenshot shows the Burp decoder for a request. If we have
an encoded request like the one in the following screenshot, then the
upper part is a request encoded in the base64 format. The lower part is
the request decoded in the clear text. I have encoded the entire
request. We can also selectively choose a portion of the request to be
decoded/encoded here.

This aspect mainly comes in to use when there is a client side
encryption of username and password in commonly used hashes or encoders.
The username/password field can be selectively decoded and the contents
can be viewed in clear text form.

Burp Comparer

Burp comparer is used when we have to compare between two sets of
data. The two sets can be a comparison of responses received for two
different requests. We can compare on the word scale or a byte scale.
The comparison shown here is of two different requests to a website. The
screen shot below shows the comparison.

The comparison can be done in two ways – Bit-by-Bit comparison and
word-by-word comparison. Burp automates this process for the user and
compares the two requests or responses accordingly.

This ends the tutorial on Burp-suite. The extent to which Burp-suite
can be used can only be left to the imagination of the user. The scanner
is not covered in this series because it’s not available in the free
edition of Burp. In the commercial edition, the scanner module is fully
functional, though with some false positives like any other application.

About the Author

Shathabheesha is a cyber security researcher at Infosec Institute and
works for a private firm in India. His interests are mainly in system
exploitation and vulnerability research.