Burp Suite Workflow

Burp Suite

For installation: tryhackme has a nice room on it.

01/usr/lib/jvm/java-23-openjdk-amd64/bin/java --add-opens=java.desktop/javax.swing=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/jdk.internal.org.objectweb.asm=ALL-UNNAMED --add-opens=java.base/jdk.internal.org.objectweb.asm.tree=ALL-UNNAMED --add-opens=java.base/jdk.internal.org.objectweb.asm.Opcodes=ALL-UNNAMED -javaagent:burploader.jar -noverify -jar /opt/post/burp/burpsuite_pro_v2023.10.3.7.jar

Intercept and redirect: (can be useful with exploit towards web apps if you want more output)

Burp setup. I used force SSL and redirected port 80 localhost traffic through the server I'm attacking.

If you want to use Burp Suite to intercept requests through proxychains:

Extensions

Check out this list: https://github.com/snoopysecurity/awesome-burp-extensions Get pro: https://www.youtube.com/watch?v=N0KQrk77BBo https://github.com/SNGWN/Burp-Suite https://repo1.maven.org/maven2/org/python/jython-standalone/2.7.3/

Free: Autorize (Detects some authorization vulnerabilities - Useful for IDOR) https://portswigger.net/bappstore/f9bbac8c4acf4aefa4d7dc92a991af2f

Hunt Scanner - Useful for finding paramters that are frequently vulnerable to any given attack https://portswigger.net/bappstore/059343223d094d16a0a8440485bc5c5e

Paid: Error Message Checks (Logs error messages - Useful for fingerprinting) https://portswigger.net/bappstore/4f01db4b668c4126a68e4673df796f0f

Passive scanning burp extension - Useful for finding new domains etc https://portswigger.net/bappstore/d927f0065171485981d6eb49a860fc3e

Param Miner - Useful for finding hidden paramaters https://portswigger.net/bappstore/17d2949a985c4b7ca092728dba871943

Bypass WAF - Adds some localhost headers to bypass a few WAF solutions https://portswigger.net/bappstore/ae2611da3bbc4687953a1f4ba6a4e04c

Logs shit, idk, try it out https://portswigger.net/burp/documentation/desktop/tools/logger

Check out if it's free or not. Finds paramaters n stuff, seems awesome: https://github.com/xnl-h4ck3r/GAP-Burp-Extension

HTTP Request Smuggler Retire.js Awesome ones I've tested: Hackvertor JSON Web Tokens JWT Editor Param Miner

Installation

have burp listening, then go here to download cert: http://burp/cert

next, go to about:preferences in firefox urlbar and search “Certificates”

then “view certificates”

then select our cacert.der certificate, and select OK with this setting:

Now, we can proxy through https fine as well! :)

virtual host routing

Under project options Use this to add subdomains if burp struggles to do DNS with your /etc/hosts