In this lab, we're going to get hands on with Burp Suite.
We're going to do some web crawling manually,
but utilizing the tool.
We saw with the proxy what a spider
can do with some web crawling.
We're going to do some manual utilizing this tool.
And then later, we could use the tool to expound on that.
So let's jump into the environment.
Check our IP address.
Grab this from here.
And we'll scan the dot three.
See that we've got HTTP server.
So let's pull it up with a web browser.
Try that again.
And it is OWASP utility.
And we're going to use this site as a good target
to find some bugs, some vulnerabilities.
We need Burp Suite.
I just typed burp and hit enter.
It opens up Burp Suite.
We just hit next on this, on the temporary project.
Start.
As soon as Burp Suite is out of date at all,
it's going to give you this out of date.
They update every month.
So it's very hard to keep this up to date.
And it knows the day, which is fine.
Which is fine.
Burp Suite is a powerful tool.
We can do a lot in here.
The way we connect this version and most versions
is in your Firefox on Kelly.
We're going to use foxy proxy to switch over and make Burp
Suite a proxy on our machine.
What it's doing, I'll show you some behind the scenes,
it's connecting to our local host on port 80 80,
which Burp Suite is listening on.
So all of our traffic is going to flow through port 80 80
when you switch to Burp Suite up here.
And you can go in manually and set up a proxy.
But using foxy proxy, it's very quick
to turn off and turn it back on.
And when you turn it on, we can go to proxy here.
We say intercept is on.
And we refresh our page.
We captured that outbound get request.
And we can forward it on.
The site refreshes.
And that's all fine and handy.
What's kind of neat in here with this proxy,
we can go to HTTP history.
And we see, oh, hey, we connected to that
seems 192.88.207.3.
And it collected it here.
Well, what we can do, we go to intercept and turn it off.
And we needed a check.
Let's go to dashboard.
Live passive crawl from proxy is turned on.
So it's capturing.
So this is sending everything to Burp Suite.
Burp Suite isn't going to intercept, just pause anything.
But we have live passive crawling on.
So then if we go back to target and HTTP
history, then when we can get--
if we say do SQL injection, we follow one of these pages.
It follow the page.
It went to index.php, that same site up here.
Page equals userinfo.php.
If we go to--
not that one.
That page doesn't work.
These submenus don't work.
You need the final.
There we go.
Index.php page equals login.php.
That matches up here.
So it is gathering everything that we go to.
So you can move your way through the whole web app
and include all of that information in this HTTP
history.
And its nifty what we can do with our history over here
is then we can launch attacks based on what we see.
And even better, if we go up to the target tab,
then we have this nice tree.
And so far, we haven't thrown any attacks yet.
But if we wanted to throw attacks,
we can set some of the stuff in scope or out of scope.
So I can add this to scope.
Add it to target scope.
And once we say yes, it'll avoid accumulating project data
for out of scope items.
So we can check our scope, and we have that site.
If we were to navigate somewhere else,
it would stop gathering information,
and it would stop acting on it.
And that is pretty neat because then, we
make sure that we don't go out of scope.
When you're using some automated tools,
you want to make sure that you aim them at the right thing.
You don't want to get in trouble.
You don't want to knock over someone's website.
It's crucial that as a pen tester, you remain in scope.
That what you agreed to with your customer, you deliver.
So that is how we do passive crawling with Burp Suite.
And it's a pretty simple lab.
Hopefully, you get a little bit of fun out of Burp Suite.
And we're going to move on from there.