Okay, guys, let me know discuss fuzzing
with burp Suite intruder.
Before we go to the demos before we
go to the Practical exercises. We need to
cover the last technical overview the technical overview
of burp Suite Intruder. And this
is what I'm going to do in this video.
Burp Suite Intruder is a part
of burp suite and burp Suite
is an integrated platform for
web application security testing.
I will tell you even more.
This is the most popular integrated platform for
web application security testing. Really
the number one. It's used by
many hackers in different corners of the world.
What is interesting here in the context of this course is
that burp Suite Intruder, which is
a part of burp Suite is used for
fuzzing and this is exactly
what I'm going to focus on right now.
So let me tell you more about birth Suite Intruder
and how it works and how to configure this
tool.
So the first thing that we have to do is we have
to specify the payload position.
Keep in mind that burps would Intruder is
a father that is used for an automated
attack. So we are going to send malicious
payloads to do web application.
And in order to do it. We need to specify the
payload position. So that burp suit
Intruder knows what to do with our
malicious payloads where this malicious payloads should
be actually sent.
And the classical placeholder is the value
of a parameter, right?
So we've got get and post parameters in web applications. So
the value of a given for
example get parameter is gonna be
a placeholder for our malicious payloads, but
we have to instruct precisely burp
Suite Intruder where this placeholder is
and this is it this is what we have to
do. So we have to specify the payload position.
We are going also to provide a list
of payloads to our father because we
are going to send many malicious payloads
to the web application and later on.
I will tell you something more about the list
of payloads.
And finally, you need to specify the
attack type.
And the default one is sniper. And
to be honest. This is the attack type
that you gonna use in 99% of
cases. So I'm not going to discuss other
attack types and I will
tell you something more about sniper because as I mentioned in
99% of cases, you're gonna use this one. So you
really have to know what this one is all about. So
sniper works like this. If you've
got a list of payloads then sniper means take
first payload from the list and send
out this payload to do web application. Then
the second pale from the list and send it
out to the web application and so on and so forth. So one
by one from the very top of the list to
the very bottom of the list and this is how it
works. Right? So this is I believe very intuitive and
it doesn't require more explanation
and this is what we want in actually 99%
of cases. We just want
to take
Every single payload and send it out to do
web application. That's why it's so popular.
Okay, and now the question that probably
comes up to your mind is where can
I find a list of payloads because
you really need a good list of
payloads for your fuzzing and let
me give you one really nice directory
with payloads that you can use
for fuzzing.
It is here.
When you go to Kali Linux, which is the most popular
a Linux distribution for pen testers, you'll find
in this location different lists
of payloads. And this location is
like this root directory user share
W fuss word list injections.
When you go out there, you will find different lists of
payloads. You will find a list of
payloads for sequel injection. You'll find
a list of payloads for path traversal.
You will find a list of payloads for
XML and more right?
But this is it. This
is the place where you will find different lists
of payloads for different types of
attacks and everything, of course in the context
of fuzzing.
And now to tell you something more about it.
This list of payloads are actually
a part of a tool called wfans.
Which is a tool also used for fuzzing but
the funny point is that you can take
this list from this tool and you can incorporate
them in birth suit Intruder and
you can do your fuzzing in burp Suite
Intruder. So this is how it works and I believe
that is clear for you and the demo
you will see how this lists look like
in practice. So, yeah,
I think that this is a clear for you and
now it's high time to jump
to the demo and show you how all this pieces
work together in practice. So
without further delay, let
me jump to the demo.