Okay, guys, welcome to the first
demo in this course probably you have been waiting
for a long time for the first demo and now it's
time to present it to you. And the
first demo is gonna be about burps with
Intruder how to use burp Suite Intruder
in practice and how to use it for fuzzing in
the context of SQL injection. So
I'm going to do here fuzzing for SQL
injection with burp sweet Intruder, okay.
So let's start.
I've got a testing web application. This is
actually an online shopping platform,
and I've got some sellers here.
free sellers David Cooper and
Michael green and Mark Ross
and I can hear do some searching by
name.
So I can put for example at David here.
I can search if there is David and indeed
there is David Cooper, right and whatever I'm
trying to search for it is sent in
the get parameter named search name,
right? So you see the parameter search
name and the value is right now David now, let
me provide something random right if I provide something
random then there is no seller like this.
And I see the message. We can't find
any seller that matches search criteria. Well, this
is expected because I provided some random characters,
okay.
Let me go back.
To sellers.php right now.
We've got this free free Sellers
and now I kind of you know thinking about
the story here. We've got some sellers
we've got some search functionality
and most probably this sellers are
stored in the database, right? This is how it looks
like in modern web applications and there is the
kind of database processing. So maybe I can
provide here some malicious payload and
maybe I am able to do SQL injection here. Who
knows let's check if this is
possible.
And now I'm gonna show you how to use
fuzzing to check whether an SQL
injection here is possible or not. Okay.
So the first thing that I have to do is I
have to an intercept the
request going out from my browser. That's the
first thing that I'm gonna do and keep in
mind that we are here in the world of web application
security testing. So it's all about requests and
responses and when you want to do
fuzzing, then you need to have a request right?
So I'm gonna first intercept the
request going out from my browser and then
I'm gonna send this request to Intruder but step by step
first. I'm going to generate the request.
From my browser and I'm going to intercept it.
What I've got here in my testing web application is
burp Suite free edition.
And one part of burp a
sweet free edition is proxy what you
can see in the upper left corner and there
is the so-called Interceptor here.
And now I'm going to turn on
the Interceptor because I'm going to intercept
the request going out from
my browser and in my testing environment the traffic
going out from my browser is sent out through the proxy. So
if I turn on the Interceptor here, I'm
going to intercept outgoing requests. Okay. So this
is how it looks like so I'm going to turn it on now. I'm
going to go to my web application.
And in the search name I will provide again something arbitrary.
and yeah search
now, let's go to my proxy.
And here you can see that indeed the request
has been intercepted you see.
There is a surgeon in parameter with some
random value, right?
Now this is this is
the proxy it has been intercepted now. I
need to send it to Intruder how
to do it.
Click, right?
And choose option send to intruder.
Okay now let me go to intruder.
and it is it is out there
go to positions and you see this is my request
right now it is
You know in Intruder and this is what I wanted to
happen, okay?
So let me know clear all this highlights.
And let me show you how to instruct the
burp suit Intruder. Where is
my placeholder for malicious payloads? Okay.
So and we are interested in the surge name parameter,
right? This is where we are sending our
data that we want to you know,
we want to find out whether a given seller
is available or not.
And we are providing the data out there or
the data that we are providing is sent in
certainly parameter, right? So this is my placeholder for
malicious data, so I'm going to
Highlight this one and once it
is highlighted.
I'm gonna click add.
and now
This is a placeholder for my malicious payloads.
Okay?
So now I instructed burp suit Intruder that
this is the placeholder for malicious payloads.
cool
And now you see the attack type
is sniper. This is what I explained
to you in the previous video.
So this is the most popular attack
type every single malicious
payload from the list is gonna be taken and put
into this placeholder.
And yeah, this is an how
it works. So we also need and the
list of payloads right? So let
me go to the payloads here.
And here you're gonna see payload options simple list
now. I'm gonna load the list
of payloads.
And the list of payloads that I already introduced to
you in the previous video is here in
the root directory user share
W fast word list injections, right?
And now I've got it open and you can
see.
That there are different lists of payloads.
There are lists of payloads
for a sequel injection and here.
here for path traversal
and we've got also for XML access,
you know, quite many and different
lists, which is really nice because it
gives us an opportunity to do
fuzzing for different kinds of vulnerableties as
I mentioned at the very beginning of this demo. I'm gonna
focus on SQL injection because this is this is the context, you
know of this story and I'll
click open.
So all this malicious payloads
have been let's say incorporated or
loaded to burps with Intruder. So what
I've got right now is I've got a list
of payloads already loaded.
And here I've got my payload
position right? I clearly marked
that. This is a payload position.
And the attack type is sniper, right? So it looks
like we've got everything now. Let me go to Intruder here.
Click Start attack, okay.
And now what you can see here kind of pop-up message
the free edition of verb contains a
demo version of burp Suite intruder.
Some functionality is disabled and attacks arm
time throttled. I will tell you something more about
this when the fuzzing is underway. So let me
click. Okay, and now I'm gonna tell you something
more about this.
I'm using here the free addition of
perp Suite you can go you can take it as the
name suggests. It's just free. And when you
use free addition, then when the
time goes on then the speed
of fuzzing decreases, right? This is
how it works. So this fuzzing works perfectly
good in burp Suite free edition. But again when
the time goes on then the speed
of fuzzing decreases and when you
want to have you know, the maximum speed
of fuzzing then we've got a problem when
you've got a free addition of
purposefute. So if you want to have
a maximum speed of fuzzing, then you
just need to buy burp sweet Pro and I really
do recommend you to do it because this is really as
I mentioned the the number one platform
for web application security testing.
But in case of fuzzing this is it
so there is a kind of a limitation but this
is a limitation related to the speed
of fuzzing the fuzzing still works very fine and
you will see it in a minute, but you cannot, you
know take out the most of it and because
this is this is the free edition, but in
terms of you know technical stuff it's
still works, but it will
be slow when you've got a long list of payloads. Okay.
So this is basically how it
works.
So now my fuzzing is underway. You can see the
progress bar at the at the bottom of
my screen.
So right now I need to wait, right? And this is how
it works. This attack is underway. And as I
mentioned this is the free edition, so it will slow
down when the time goes on but it
works perfectly good again. I really want
to emphasize this because I don't want to tell you
don't use at all free edition. No, you can still use
it but there are some limitations and I want to point them out,
right?
Okay, the the fuzzing is underway. So I'm
going to post this video and I will come back in about
three four five minutes something like this when
the fuzzing is done. Then I'm gonna jump to
the interpretation of the results. Okay. So let
me post the video right now and let me get back
after a couple of minutes.
Okay, guys, I'm back.
After a couple of minutes, the fuzzing
is done right now. So the next
step is manual verification, right?
So we asked burp Suite Intruder
to do an automated attack for us.
The automated attack has been
finished. Now. We need to go to manual
verification. We need to find out whether
there are some anomalies in
the responses or not. So this is exactly what I'm
going to do here. You see the different
responses, right? So like status code
length of response, right?
We can see different things like
weather error has occurred timeout stuff like
that and here of course, we've got payloads.
And now we need to
find anomalies as I mentioned.
So I'm going to do some kind of sorting right
now in ascending or descending order
just to see if we've got some anomalies or
not.
So I will click status here.
And sending descending orders, right?
All the time, I see 200.
Now error the same ascending descending.
All the time. I see that you know,
nothing has changed timeout.
The same no anomalies and length right
now.
Oh, can you see something interesting?
Now I've got a descending order.
So for one payload the pale like this here.
For this payload, I've got the length of
response 10,6004 and
for all other payloads the
length of response is 4,933. So
yeah, we've got an anomaly here,
right? And for some reason for this payload, we've
got a length of response like
over that 10,000 bytes,
right? It's interesting. So, let's see what we've
got here for the length for nine
free in the response. Let me analyze the
response right now.
So in the response, I'll switch to
render here.
Sorry, we can't find any seller
that matches search criteria, right?
So this is what we see here when the length of
response is 4933 but here
when the length of response is 10,6004.
I can see different names and
this is strange David Cooper Michael
green and Mark gross. These guys are the sellers and now
Russell Washington Angela Harris Daniel Robinson
Carl Martinez and a lot
more.
Hmm this is surprising.
So there are free sellers.
in my online shopping platform,
and now when I provide this payload
I see a lot more people.
So most probably these people are customers because
if I've got free Sellers and I've
got online shopping platform and most probably the
rest guys are customers. So
it looks like we've got an SQL injection that
results in fetching more data
from the database than we are supposed to fetch. And
yeah, this is something that
really looks like a valid escuel injection and
you can take it right now and you
can report it to the backbounty program
owner.
And you can get money for finding like
this one and this is how it works. So I found out
an anomaly and then I decided
you know to analyze what happened
here and I figured
out that most probably and I see also the
customers and I shouldn't be able to
see this data obviously. So yeah, it looks
like a true positive and here is the payload
that you have to
send out to the web application and then in response,
you're gonna see a lot more
data than you are actually supposed to see so this
is how it works. This is how fasting works.
You see we've got an Automation and then manual verification
and now you can think about this payload
why this one payload results in
this kind of behavior? Why this
payload results in SQL injection and
I will give you an answer. You don't have
to go into the details here your point is
to to manual verification and
see if this is a true positive or false
positive. You really don't have to go into the details
of of you know, thinking of what might have
happened out there. This is also the power of fuzzing if
you know the recipe just apply this recipe
and then make an interpretation find
anomalies try to figure out
whether you've got a false positive or
too positive and you don't have to, you know, go into into
the details of a given payload because
you don't know the implementation again in 99% of
cases in backgrounds, you don't
Know what is the implementation and you don't have to
know in Black Box testing. It works perfectly good.
I mean, you've got a payloads you analyze responses
you interpret the responses you interpret
the anomalies and you make some conclusions and and
based on this conclusions. You construct a report and
send it to the bug Bounty program owner. This is this is
how it works. So I want to tell you that you don't have to go into
the details of why this particular payload
my work or or maybe not working.
Right and this kind of stuff. I have found really
nice four digit bugs with
fuzzing where I had no idea why I given
payload work. I mean, I have some kind of ideas in
my mind but on the other hand, this is
Black Box testing and the goal here is to
prove that a given attack is possible. Right? And
that's it. That's what I want to tell you.
Okay. So basically this is it for
the first demo. I hope that you understand everything.
Ink and if you don't understand everything don't worry
because in the next demo I'm going to do the
steps again, but in
the context of different different attack, so you
will have more opportunities to practice.
With burp suit Intruder and fuzzing. So
I hope it has been informative for you and let me
now jump to the second demo.