Burp Suite - Revision history

Unknown user: /* Links and Resources */

2023-06-04T20:22:56Z

Links and Resources

← Older revision		Revision as of 20:22, 4 June 2023
Line 178:		Line 178:

	=Links and Resources=		=Links and Resources=

			==PortSwigger Training==

			SQL injection training: [[Burp Suite/SQL Injection]]

	==Official Tutorials==		==Official Tutorials==
Line 207:		Line 211:
	* Tampering with parameters - setting parameter to string instead of integer leads to 500 error, and stack trace is shown		* Tampering with parameters - setting parameter to string instead of integer leads to 500 error, and stack trace is shown
	* Stack trace shows version number of software package		* Stack trace shows version number of software package

	~~Tutorial 3: Running your first scan: https://portswigger.net/burp/documentation/desktop/getting-started/running-your-first-scan~~

	* Professional version only

	=Flags=		=Flags=

2023-05-21T16:00:31Z

SQL Injection

← Older revision		Revision as of 16:00, 21 May 2023
Line 166:		Line 166:

	{{Main\|SQL Injection}}		{{Main\|SQL Injection}}

			{{Main\|Burp Suite/SQL Injection}}

	Can use Repeater to easily capture a vulnerable request, and use it to craft SQL injection queries. Repeater makes it easy to convert plain text SQL queries into URL-encoded queries.		Can use Repeater to easily capture a vulnerable request, and use it to craft SQL injection queries. Repeater makes it easy to convert plain text SQL queries into URL-encoded queries.

2023-05-21T15:58:37Z

Admin moved page Burpsuite to Burp Suite

← Older revision	Revision as of 15:58, 21 May 2023
(No difference)

2022-04-13T19:52:07Z

Specific Types of Attack

← Older revision		Revision as of 19:52, 13 April 2022
Line 172:		Line 172:

	{{Main\|XSS}}		{{Main\|XSS}}

			Cross-site scripting involves manipulating the page that the browser is loading, in order to allow an attacker to inject Javascript that is run by the victim's browser. This provides the attacker to compromise the user's interaction with that web application.

	=Links and Resources=		=Links and Resources=

2022-04-13T19:49:24Z

Specific Types of Attack

← Older revision		Revision as of 19:49, 13 April 2022
Line 168:		Line 168:

	Can use Repeater to easily capture a vulnerable request, and use it to craft SQL injection queries. Repeater makes it easy to convert plain text SQL queries into URL-encoded queries.		Can use Repeater to easily capture a vulnerable request, and use it to craft SQL injection queries. Repeater makes it easy to convert plain text SQL queries into URL-encoded queries.

			==Cross-Site Scripting==

			{{Main\|XSS}}

	=Links and Resources=		=Links and Resources=

2022-03-17T00:43:56Z

SQL Injection

← Older revision		Revision as of 00:43, 17 March 2022
Line 167:		Line 167:
	{{Main\|SQL Injection}}		{{Main\|SQL Injection}}

	~~{{Main\|Burpsuite/~~SQL ~~Injection}}~~		Can use Repeater to easily capture a vulnerable request, and use it to craft SQL injection queries. Repeater makes it easy to convert plain text SQL queries into URL-encoded queries.

	=Links and Resources=		=Links and Resources=

2022-03-17T00:18:40Z

SQL Injection

← Older revision		Revision as of 00:18, 17 March 2022
Line 164:		Line 164:

	==SQL Injection==		==SQL Injection==

			{{Main\|SQL Injection}}

	{{Main\|Burpsuite/SQL Injection}}		{{Main\|Burpsuite/SQL Injection}}

2022-03-07T02:36:43Z

Usage

← Older revision		Revision as of 02:36, 7 March 2022
Line 160:		Line 160:

	Repeater won't automatically generate edits, or create a bunch of requests for you. It is intended to make the manual workflow of modifying requests and examining the responses easier.		Repeater won't automatically generate edits, or create a bunch of requests for you. It is intended to make the manual workflow of modifying requests and examining the responses easier.

			=Specific Types of Attack=

			==SQL Injection==

			{{Main\|Burpsuite/SQL Injection}}

	=Links and Resources=		=Links and Resources=

2022-03-03T01:10:31Z

Modifying Target Scope

← Older revision		Revision as of 01:10, 3 March 2022
Line 136:		Line 136:

	* The second way is to go to the Target tab, find the site example.com, right click on the site, and include it in the Target Scope. Then collapse the tree, and find the location to exclude, <code>/assets</code>. Right click on that folder and exclude it from the Target Scope. Now add an intercept rule that limits intercepted requests to ONLY URLs that are in the target scope.		* The second way is to go to the Target tab, find the site example.com, right click on the site, and include it in the Target Scope. Then collapse the tree, and find the location to exclude, <code>/assets</code>. Right click on that folder and exclude it from the Target Scope. Now add an intercept rule that limits intercepted requests to ONLY URLs that are in the target scope.

			====Intercepted Request Actions====

			When a request is intercepted, there is an "Action" menu at the top that has a lot of useful functions.

			Two submenus in the Action menu, "Don't intercept requests" and "Do intercept requests," will automatically create Intercept Rules based on various fields of the intercepted request - for example, the host, the IP, the file extension, or the directory in the URL.

			This makes it easy to narrow in on the requests of interest: start by intercepting all requests, then use the Actions menu to filter out requests that aren't interesting.

	==Repeater==		==Repeater==

2022-03-03T01:06:34Z

Useful Intercept Rules

← Older revision		Revision as of 01:06, 3 March 2022
Line 118:		Line 118:
	Rules are processed in order, top to bottom. No scope.		Rules are processed in order, top to bottom. No scope.

	====Useful Intercept Rules====		====Useful Client Intercept Rules====

	A few useful intercept rules to have available to be enabled:		A few useful intercept rules to have available to be enabled: