Learn Burp Suite, the Nr. 1 Web Hacking Tool

In this lecture we will cover the general concept of the Burp Proxy. I will explain how the test architecture works and we will discuss the basics of the Burp Suite.

We will start the detailed examination of the Burp Suite in this lecture. First we look at the Proxy module which allows us to inspect all traffic going through Burp.

The Repeater module of the Burp Suite allows us to do convenient manual testing. We will get to know this module by exploiting a cross-site scripting vulnerability in the WebGoat.

In this lecture we are going to discuss two modules, the Target and the Spider. I will show how you can use the Target module to get a better understanding of the structure and how to use the Spider to discover every hidden parts of the target application.

We will first look at the Sequencer to test the randomness of various elements. In the example we will analyse the entropy of the JSESSIONID cookie. Although the Scenner is not part of the free edition of the Burp Suite, I will still introduce it, to make sure that you make an educated decision when you consider buying the pro version.

In this lecture we are going to try the Intruder module, which is the semi-automated testing tool of the Burp Suite. We are going to brute-force the "Password Forget" feature of the WebGoat. The Comparer will be also used in this attack to make your testing more efficient.