Lesson 03: Burp Suite Training
Lesson Objectives
By the end of this lesson, students will be able to:
● Understand the core features and purpose of Burp Suite in web application security testing.
● Set up and configure Burp Suite for use with browsers.
● Intercept and analyze HTTP/S requests and responses.
● Perform basic security tests such as XSS, SQLi, and authentication bypass using Burp Suite tools.
● Use modules like Repeater, Intruder, and Scanner effectively in a lab environment.
1. Introduction to Burp Suite
Burp Suite is a powerful integrated platform used for web application security testing. It allows security testers to
intercept, inspect, and modify traffic between a browser and a web server.
Key Features:
1. Interception Proxy
2. Request/Response Analysis
3. Automated and Manual Scanning
4. Web Vulnerability Testing Tools
5. Extensibility via BApp Store (Burp Extensions)
2. Burp Suite Editions
1. Community Edition: Free, limited functionality (manual tools only).
2. Professional Edition: Paid, includes active scanner and advanced automation.
3. Enterprise Edition: Designed for large-scale automated scanning.
3. Setting Up Burp Suite
Prerequisites:
1. Java installed (Burp is Java-based)
2. Browser (usually Firefox or Chrome)
Setup Steps:
1. Install Burp Suite (Community or Pro).
2. Configure browser to use [Link]:8080 as a proxy.
3. Install Burp CA certificate in the browser for HTTPS interception.
4. Test by visiting a site and observing traffic in the Proxy > HTTP history tab.
4. Burp Suite Tools Overview
4.1 Proxy
1. Intercepts browser traffic.
2. Modify requests and responses in real time.
4.2 Target
1. Maps the application and shows the site structure.
2. Scope configuration to limit testing area.
4.3 Repeater
1. Resend and modify individual requests.
2. Useful for manual testing and exploiting parameters.
4.4 Intruder
1. Automate customized payload attacks (e.g., brute force, fuzzing).
2. Common use cases: password guessing, parameter testing.
4.5 Scanner (Pro Only)
1. Automated scan to identify vulnerabilities like XSS, SQLi, etc.
4.6 Decoder
1. Encode/decode data in various formats (Base64, URL, Hex).
4.7 Comparer
1. Compares two requests/responses to highlight differences.
5. Practical Lab Examples
5.1 Intercepting Login Request
1. Capture a login form submission.
2. Observe parameters like username and password.
5.2 Manual SQLi Testing
1. Send vulnerable parameter to Repeater.
2. Try SQL payloads like ' OR '1'='1.
5.3 XSS Injection
1. Modify a search parameter to include <script>alert(1)</script> and test response.
5.4 Brute Force Login with Intruder
1. Set attack positions.
2. Use a password list (e.g., [Link]) for dictionary attack.
6. Real-World Use Cases
1. Penetration testing for web apps.
2. Bug bounty hunting.
3. Identifying insecure cookies, headers, and tokens.
4. Exploiting logic flaws and broken authentication mechanisms.
7. Legal and Ethical Guidelines
1. Only use Burp Suite on systems you own or are authorized to test.
2. Testing live websites without permission is illegal.
3. Respect privacy and data handling policies during tests.
4. Always document findings responsibly and report vulnerabilities ethically.
8. Summary & Key Takeaways
1. Burp Suite is a must-have tool for any web application security tester.
2. Key modules include Proxy, Repeater, Intruder, and Scanner.
3. Hands-on practice is essential to mastering Burp Suite.
4. Always follow ethical guidelines and use in authorized environments only.