Now that we understand, get and post requests and understand the theory and the reasons behind using
proxies in this lecture, I'm going to introduce you to the proxy that we will use throughout the course
to intercept and modify requests.
We're going to use a proxy called Proxy, which is part of a popular penetration testing tool kit called
Sweet.
You can find berp here on the left, in the dark or under the applications menu.
Once you start it, it's going to ask you if you want to run a temporary project or run from an existing
one.
We're going to go with a temporary one.
If you're using the custom image, you'll see it's going to load by default with this config file.
We're going to keep it the same.
Click on start and you're going to get the default window of berp.
Now, as you can see, this is a large tool kit that can be used to do a number of things.
But what we're interested in, in this lecture is the proxy part of it.
If I make this window a little bit bigger, you'll notice that the interceptor is on, meaning all the
requests sent to this proxy will be intercepted and therefore will be able to analyze them and modify
them if we want to.
Now we're going to click on Open Browser to open the builtin browser that comes with burb, and you'll
notice that this is simply a normal Web browser that you can use to load any website.
But when the interceptor is on, you'll see that any request that this browser sends will be intercepted
by burb before being forwarded to the actual destination.
So let me show you an example.
First, we're going to turn off the interceptor and now this browser will work like a normal Web browser.
So let's go to our target, which is 10 2014 to 09.
And let's go to you a and log in.
And now if I turn on the interceptor and click on any link in this page, for example, let's click
on the file inclusion, you'll notice that the website will continue loading, but nothing will actually
load.
It seems as if there is no connection in here.
But the reason for this is because berp intercepted the request intercepted.
What happens when I click on a link in here and we can see that the website is, first of all, trying
to send a post request to this particular path and we can see the content of this request.
So we can see the headers.
We can see that this is actually go into Google, we can see the contents of it.
And if we click on forward, this will actually be forwarded to its destination and then we see the
next request that is being sent.
So we can see we have another get request.
This time it's being sent to this particular domain and this is the path that it's being sent to.
Again, if we click on Forward, this will be forwarded and now we have another request.
This time it's a get request and this one is actually being sent to our target domain.
So it's the same domain as we have in here.
And this time it's asking for this particular path.
It's given a parameter called page and the value that is being sent is included.
You can also see the rest of the values that is being sent.
And all of this is simply a text box.
So you can actually modify any part in here.
Click on forward, and this request will be sent with the modifications that we made in here.
So anyway, I'm keeping this the same, and the next thing that I want to show you is the inspector
in here on the right.
If I click on that to expand it, you can see that all of the values that are being sent in here are
categorized in here in nice categories.
So if we click on the query parameters again, we can see the page parameter.
We can see it in here and its value is included.
What we can see it in here.
And if we double click on this again, we'll get text boxes where we can simply modify any of these
parameters and values as we wish.
Click on apply changes and forwarded.
Whatever modifications we make to this request will be forwarded to the Web server.
This allows us to, first of all, bypass client side checks and security implementations.
And it also allows us to see that that is being sent us post requests and other types of parameters
that are being sent to the Web server without being displayed in here in the URL box.
This is very useful because we should test all of these parameters for all of the vulnerabilities that
we're going to learn in this course, and therefore it expands our attack surface.
So anyway, as you can see, this page still has imploded while I click because I clicked on file inclusion
and I still haven't got that because I haven't forwarded this request yet.
So, again, we're going to click on forward and keep clicking on forward to forward everything.
And once we do that, as you can see, we finally got the page that we requested, which is file inclusion.
So the whole idea and the whole point of using this proxy is to intercept all of the requests that the
page will send to the Web server in order to be able to see these requests, modify them and hopefully
use them to discover vulnerabilities.
Let me show you another example.
So I'm going to turn off the interceptor and we're just going to go to the upload.
And we're going to turn it on and let's upload a file and we're just going to go to my downloads and
upload the JTR picture in here, click on upload.
And again, you'll see that we're going to get stuck because the request is being intercepted in here
and burb.
We can see this time it is a post request.
Therefore, we don't really see anything here in the URL bar and we can see that this is being sent
to this path in here, DPW vulnerability's upload.
And if we scroll down, we can see the file name right here.
We can see the content type and we can see the actual content of the image.
This is the actual binary content of the image itself.
So again, this binary content can be modified, the content type can be modified, the picture name
can be modified.
Anything you see in here in text can be modified.
And we can also see the post parameters that are being sent in here under the body parameters.
Again, as mentioned, we don't see anything here in the URL because everything is being sent as a post
request.
But clicking on the budget parameters in here, we're going to be able to see the maximum file size
allowed, the content of the image and another parameter called uploading.
We can also see the requested cookies in here and we can see the request headers.
All of it can be modified by simply double click on it and then forward the request.
Now, I'm not doing any modifications in this lecture.
We're going to do that later on in the course.
And this lecture, I simply just want to introduce you to the idea of intercepting the requests and
modifying them before sending it back to the Web server.
So, again, if we click on forward and forward, the rest of the requests, you will see that the picture
will get uploaded successfully and there are no more requests being sent to the Web server.
So that's pretty much it.
I know we haven't really hacked anything, but this is very useful to expand your attack surface, like
I said.