The proxy that we're going to be using is birth proxy.
Now birth is a really big program that can be used for a lot of things but we're going to be focusing
on how to use the proxy in this lecture.
So we're going to be using the proxy in a lot of lectures.
I'm going to explain how to run it and configure the browser to use it once.
And in the future I'll be skipping through this step.
I'm just going to say I'm going to run Bert proxy and you should carry out these steps.
So hope Burke is going to work as we have outlined here and we have the web server just like we've seen
it before and we have BHM a website loaded on our candy machine.
So when we send the request and we said instead of sending it directly to the web browser we're actually
going to configure our browser to send the request to burp.
So this is our proxy running here.
Bert you'll see all the parameters that are being posted to the Web site.
So we're going to see the post request they get requests and we'll see them after all the client code
has been applied.
So some Web sites apply client side code.
As I said to the request before they send it.
So we're going to be able to see the requests after the client side code has been applied.
This is very important because a lot of Web sites use filtering as client side.
And then we'll be able to bypass all of these filters by intercepting the request.
Then once we modify the request in birth we're going to forward it to the Web site the website will
execute it and give it back to us.
So again we're going to redirect the requests to burp modify them here send them to the Web site Web
site executes it give it back to us.
Now we're going to be using this a lot in the future and the idea will become much more clear in the
future.
So if you don't really get it now just keep going through the lectures and I think it'll become much
more clear.
Let me show you how to configure burp.
So first of all I'm just going to start work so you can run it here from the dock or you can run absoute
from the terminal.
Now this is just telling me about some Tim project I had We're just going to click next to use a template
project and we're going to use the defaults.
So we have a problem here.
And as I said it's a really big Seuthes with a lot of options.
What we're interested in the proxy so we can see that the proxy is set to ON and the most important
thing now is to go on options and you'll see that the proxy is running on port 80 80 OK.
Now anything we do here is still not centerboard because we are not redirecting anything to it yet.
So we need to set up this we need to tell our web browser to send all the requests to the port that
verb is running on.
So Burke is running on 88.
So now I'm going to go to my preferences.
I'm going to go in advanced network settings and we're going to use manual proxy configuration and we're
going to use port 80 80 and the IP is 7 0 0 0 exactly like it's in here.
And the options I'm going to click on.
OK.
And now anything I do on this web browser will be redirected to burp before it goes to the website or
anything I do here will be redirected to the proxy.
I can modify all the requests and send it to the web server.
So let's see how is this going to work so I'm going to go back here to the intercept and I'm just going
to click on any link in here.
So if I just go for example on the file inclusion you'll see that perp here has intercepted a packet.
And if we go here on the parameters
you'll see the stuff that perp is sending.
So we can see that it's asking for a page called include poetry.
It's telling that the security should be low and it's sending.
SS ID.
So again on the headers you'll see all the headers that's been sent and you can modify any of these
values by double click on it.
So you can modify this double click it modify it.
Hit enter and then once you're done modifying it you can click on forward and that will forward the
packets and then the page is displayed here.
Now we're going to be able to find these things in the future.
So right now I'm just showing you that the bar is set up correctly and in the future will be modifying
that.
Let me just show you an example of a follow up.
Now again if I click on file upload nothing happens.
I have to forward it back here so you can see the values that we use and you can see the headers here
as well.
And I have to forwarded then the website will load it here and I have to forward again.
And as you can see now it loaded.
So let's try to upload an image.
And when I click on upload again you'll see that the website pauses and we can see all the stuff that
we send in here.
So you can see that the image name you can see the image type and you can see all the variables that
we insert as well.
Again this is a post request and usually you don't see anything in here in the or out.
We can modify the values in here and then send them again.
This might not make much sense now but in the future once you start learning other attacks and we'll
be using.
You'll see how useful this can be.
Once don't use unberth because now if you if we close were the browser will still try to redirect the
packets to port 88 you were purpose running.
So if I try to open anything I will lose my connection because it's the proxy server is refusing connections
because I self burp.
So once you're done with Bergh go back to your preferences and make sure that you use you set up your
proxy settings to not use a proxy.
So advanced network settings and then go to no proxy.
OK.
And then you should be good to go.
Now if I do I try again.
The website works as well.
So again this is going to be really handy to intercept post get and bypass filters and also bypass any
type of client side code that gets applied to the requests made by the website in the future I'll be
doing this very fast and once I say I'm going to use BEARUP you should take it that you need to start
up and configure your browser to redirect packets to go through burp.