Okay, guys, welcome back in the second
demo.
In this demo, I'm going to show you
how to use burp suit Intruder to
do fuzzing for path traversal. I've
got here the same testing web
application. So this is an online shopping platform. And
now I'm gonna change the language the
preferred language. The default one is English now, I'm
Gonna Change it to German.
And you see the message this language is not supported
yet. Okay, what's more
the value of this language is sent
in the URL. I believe that you can see it. There is
a parameter named language with
the value German. So let me now change the
value to English.
And you see the message your language has
been changed to English.
call
and now I'm going to provide some arbitrary data.
This language is not supported yet. Well for sure
it is not supported yet.
And now let me think about it. What is happening
here or what might be happening here.
When we've got different translations, you know
different translations of web pages,
then it may happen that this
translations are fetched from a file.
From the web server, right? So let's
assume that we've got for example.
Language like English and Chinese,
okay.
And we can have two
different files with two
different translations. And when we change this language
preferred language from English to Chinese
to Japanese, whatever and then it may happen
that this translations are taken out from the
files on the web server and
then they are just, you know returned to
us to users. This is how
it works in in different web
applications.
And when something like this happens,
then it may be possible via language
parameter to fetch other
a files from the file system of
the web server, right? It may be possible. You
never know. You never know how it works on the server
side. You can just you know use your own
experience. You can just you know have to
make some interpretation here about the context and
now I'm not saying that for
sure it works this way. I as a backhander
need to you know, imagine what may
happen and when I see something like this that
it may happen that the translations are fetched
from the files from the file system
of web server. Then what comes
up to my mind is potentially I may be
able to do puff traversal attack.
What I can do as a result of puff traversal attack
is I can fetch arbitrary files
from the file system of the web server,
right? So you see this this kind of thinking and
and this kind of thinking is very important at the very
beginning. Okay?
Okay, so far so good. So let's
do fuzzing of language parameter for
path traversal. It makes sense because
I man might be
successful. When I do this kind of testing and I try
to explain you why I think in this way, okay. So
now I'm gonna resend this
request and I'm gonna intercept this
request in proxy. So I'm gonna repeat the
steps from the previous from the previous demo. So
let me turn on the Interceptor now, let's go
here to do a application. I'm gonna
hit enter.
let's go back to
The proxy here it is the intercepted request.
You see we've got language parameter with
arbitrary, you know
value but the value does not matter. It's gonna be in a
minute placeholder for my malicious payloads,
but later on now click right
send it to intruder.
Now, let's go to intruder.
Let's go to positions.
Everything is highlighted right now.
So let me clear it out.
Now I want the value of language parameter
to be a placeholder. So let me highlight it.
And once it is highlighted, I need to click
add.
And now this is a placeholder for my
malicious payloads. The attack type is sniper. You
already know what it is.
And now let me go to the payloads.
payload options simple list load and
this time well again,
I'm interested in this list of
payloads from from
this location and but this
time
I am interested in traversal.txt right
because I'm gonna do fuzzing for
past traversal.
And let me click open right
now.
And I've got a bunch of different payloads for pathfroversal.
And now when you've got a burp suit
professional Edition, then you can add your
payloads from this list right from
the list of burp suit pro at payloads,
but in free edition of perp Suite
you don't have this list.
And this is the additional reason why I'm
presenting the list of payloads from wfas because
you can take them for free and you
can launch your fuzzing and you will really be
successfully many cases. So again, you don't have
to have burp suit Pro. It's helpful
when you've got burps with Pro because there are no
limitations related the speed of fuzzing and you've got
in burp suit Pro the list of payloads for
different attacks, but it is not necessary. Right?
And this is what I'm trying to explain to you. Okay, so
we've got everything right now.
So we need to start our attack. So let's go to Intruder. Click
Start attack again. We see
this message about a time throttle
attacks. This is what I already explained to you. Let
me click. Okay, and yeah, then
the fuzzing is underway.
So again, we have to wait and a
couple of minutes.
Or sometimes well, it depends actually on
your list of payloads. If
you've got a very long list of payloads, then it
will be longer. Right but approximately
you have to wait a
couple of minutes and until it is finished.
So let me right now post the video and
let me get back to you once it is done.
Okay, the fuzzing has finished.
So now the next part is
manual verification. So as you already know we
need to find out whether there are some anomalies
out there. So let me first, you
know, make it a little bit bigger because you don't see the
payloads out there. So yeah anomalies let
me do again some sorting ascending the sending order for
different, you know for different
things like status.
I don't see an anomalies for error. Also.
I don't see for timeout no length.
Oh, there is something interesting. Can you see
now? I've got a descending order.
And I've got many different lengths.
3731
right
And I've got a couple I got
three lengths 6000.
297 it's interesting. Let's
see. What what's that when I've got for
example this one 3731
What's the what's the response?
The response is this language is not supported yet.
Okay, so I provided a lot of payloads that
resulted in this response. This
language is not supported yet. It makes sense. But what happened
for this payloads here?
Oh, what a nice response. Can you
see that?
This is this is the content of
Etc past WD.
So this is a nice proof of concept showing that
path traversal indeed is
possible. I was able to fetch the file.
That should not be visible to me. Right? And yeah
puff traversal is possible and
you can see that this is
a very nice proof of concept for puff traversal. I
can use puff traversal tag
via language parameter and
I can extract arbitral files
from the file system of the
web server. Very nice. Very cool. And this
is it just take this payload. You
can see this payload here that was responsible for
fetching the content of this
file the Slash the slash those slash a
couple of times Etc past WD
and percent zero zero, which is URL included
now character and when we've got this payload,
then we can see
Add the content of EDC +
WD file, which is really cool.
So now you can see yet another example of how
to use burp suit
Intruder for fuzzing and it was presented in
the context of tough traversal, but
this knowledge is is you
know, generic what I mean here is that you've got
and recipe right. Now, you can
apply this recipe to find a
different vulnerabilities in
web applications. Right? So we've got a recipe for
fuzzing with burp suit Intruder now, you just need to
take a list of payloads dependently on
what you are looking
for right dependently on the context in the
previous demo. I presented to you how to do fuzzing
for SQL injection in this demo how to do fuzzing for
pastoral but there are other lists as well
for XML for xss for bad
characters, right? I present to you the list
of payloads in wfus.
Different classes of vulnerabilities right but when
you've got this recipe, then you can just you've got
the doors open right now. You can do
a lot of testing on your own because you've got the recipe
this is this is the most important thing and
yeah, this is what I wanted to tell you at the
very end of this demo. So I hope that it is right
now clear for you and let me right now
jump to another video.