📱 Mobile Security Tips
Mike Torres — Android Security Engineer
What is Burp Suite?
Burp Suite is a popular web application security testing tool that allows security professionals to find vulnerabilities in web applications. It acts as a proxy server, allowing users to intercept and modify HTTP(S) requests between their browser and the target application. With a suite of tools such as the scanner, intruder, repeater, and more, Burp Suite is essential for penetration testers and security analysts.
Installation
Burp Suite is available for Windows, macOS, and Linux. It can be downloaded from the PortSwigger website and installed with minimal setup. For command line installations, especially on Linux, you can use:
wget https://portswigger.net/burp/releases/download?product=community&version=2023.8.1&type=jar -O burpsuite.jar
java -jar burpsuite.jar
Basic Syntax
Launch Burp Suite from the terminal with:
java -jar burpsuite.jar
Discovery
Discovery is the first step in identifying the target’s attack surface. Burp Suite provides tools for crawling applications and discovering endpoints.
Site Map
Once you start intercepting traffic, the Site Map panels will populate with discovered endpoints. You can right-click on any endpoint to:
| Action | Description |
|---|---|
| Add to Scope | Limit scanning to relevant parameters |
| Send to Scanner | Initiate vulnerability scanning |
Spidering Tool
To perform an automated crawl, use the spidering functionality:
Target > Site Map > Right-click Target > Spider this Host
Scanning
Burp’s scanner can automatically find a wide range of vulnerabilities during an active session.
Initiate a Scan
To start an active scan, right-click a request or the entire site and select:
Scan > Active Scan
Exploitation
Burp Suite provides tools for manual exploitation of identified vulnerabilities. Use the Intruder tool for brute-force attacks or custom payload delivery.
Using Intruder
Set up payload positions and configurations:
Intruder > Positions
Afterward, to run the intrusion:
Intruder > Start Attack
Analysis
After scanning and exploitation, users can analyze results from vulnerabilities discovered.
Review the Issues Tab
The Issues tab will provide severity ratings and detailed descriptions, helping prioritize remediations based on risk.
Evasion
Burp Suite allows you to modify requests to bypass security controls.
Modifying Live Requests
To modify requests on the fly:
Proxy > Intercept > On
Reporting
Generate comprehensive reports of the findings.
Generate a Report
To generate a report:
Reporting > Generate Report
Choose your report type based on needs (PDF, HTML, etc.).
Quick Reference Table
| Command | Description |
|---|---|
| java -jar burpsuite.jar | Launch Burp Suite |
| Target > Site Map | View discovered endpoints |
| Scan > Active Scan | Start scanning for vulnerabilities |
Pro Tips
- Utilize Burp Suite extensions for additional functionality. Explore BApp store.
- Use the Match and Replace feature for session management bypass.
- Enable Automatically find and exploit CSRF in the scanner settings.
Real-World Examples
Consider a recent pen-test where an automated scan identified 30 vulnerabilities, prioritizing findings allowed the team to remediate high-risk issues first, effectively using the Site Map for exploit verification. The use of Intruder for password enumeration further unveiled an admin account.