Okay guys some welcome back. I hope
that you liked the content of the course that has been presented so
far.
And in this video, I'm going to tell you
more about fuzzing with burp Suite Intruder. It's gonna
be about tips and tricks. I'm going to
go into some options of burp
suit Intruder that I find really helpful.
So let me discuss them right now. I'm gonna
first focus on request engine which is here. And especially
I'm going to focus on the throttling.
Throttling is here.
And you know throttling is
really important when you
are a Buck Hunter because when you play in
bug Bounty programs, I very briefly introduced this
programs in one of the previous videos, then you
have to obey the rules the companies
allow you to hack them legally, but
you have to obey the rules and very often
one of the rules is like this.
You can use fuzzing provide that you
are sending one request per second.
The backbounty program owners don't
want to be overloaded with
the traffic that you are sending out.
And that's the reason why they want you to
limit the speed of fuzzing.
And well, you have
to obey the rules if you don't want to end up
with problems.
So the natural consequence is that you need to
go to the settings of burp suit Intruder and you
need to instruct the birth city Intruder dear burp
suit Intruder don't send more than
one request per second. Okay?
You can do it in burp suit Intruder. The problem is that you
can't do it in a free edition of birth suit
intruder.
What I've got here is the burp suit free as you
remember from the previous demos and
you can see here. I cannot
edit this things right? I cannot edit
these things so I cannot play
with throttling.
I cannot introduce delays in between consecutive
requests going out from this father
and I've got a problem how you
can solve this problem. Well, you can buy for example burp
suit Pro so professional Edition. I
really recommend it has a lot of great features that
are really worth the price.
And as I mentioned a couple of times throughout this
course, this is really the number one platform for web application
security testing. So this is really good. But now
I'm I'm showing you real problem or
problem challenge that you're gonna have when you
do a fuzzing in back
Bounty programs, right? So I'm showing you something really
realistic and you have to you
know, keep it in mind when you do fasting so fraught link
really is really important.
And the next point that I'm
going to discuss.
Is related to grep much
functionality and in
grep much functionality. You can
just ask the burp
Suite Intruder to highlight the
responses that include some keywords. You
already know that we are talking here about
requests and responses. We are going to find some
anomalies in responses and
stuff like that.
And what will help you in your analysis and
it is supported in free edition
of burp a suit is that you can ask burp Suite
Intruder to highlight the
responses that include some keywords
like for example stuck.
Illegal exception error, right when you've
got this kind of keywords in
responses like a stock or exception and
then it means that well most probably
we've got a stack Trace in the
response or you've got some exception that
has been triggered. So it means that basically you are one step
before finding a vulnerability, right?
And in other words, it indicates that there
is probably a vulnerability out there and this
is a good message for you and you want birth to
Intruder to inform you about this stuff and
how to do it. You've got a very nice option
here. You can click it.
Flag results items with responses matching
this expressions and that's it.
Right and then when this is checked, then you
will see highlighted responses with this
keywords and it will speed up
your analysis. You will be more effective in
finding some anomalies in finding
vulnerabilities. So this is also what
I recommend you to do and you can also specify here
your own keywords, right? You can
put it here click add and this is it.
So this is very nice and I recommend
you to play with it as well.
So, okay. So this is it about the tips and tricks that I really
find useful and I hope
that this is clear for you. So let me jump to the next video.