📱 Mobile Security Tips
Mike Torres — Android Security Engineer
What is Burp Suite?
Burp Suite is an integrated platform for performing security testing of web applications. Its various tools allow security analysts and penetration testers to conduct assessments ranging from initial mapping and analysis of application attack surfaces to finding and exploiting vulnerabilities.
Installation
Burp Suite can be downloaded from the official PortSwigger website. It is available in different editions, including Community (free), Professional, and Enterprise. Installation is straightforward and usually involves downloading the installer and running it on your system.
Basic Syntax
The basic usage of Burp Suite involves launching the application and configuring your web browser to work with it. You generally will configure your browser to use Burp as a proxy (default is 127.0.0.1:8080).
Discovery
Finding URLs and Hidden Content
COMMANDS
Intruder > Target > Add (to define your target)
Site map > Right click > Spider this site
Scanning
Active Scan
COMMANDS
Target > Scope > Add URL to scope
Scanner > Right click on target > Active scan
Exploitation
Using Intruder for Attacks
COMMANDS
Intruder > Positions > Clear > Add payload positions
Intruder > Payloads > Select type (e.g., Simple list, Numbers)
Analysis
Reviewing Issues
COMMANDS
Dashboard > Issues tab > View reported issues
Evasion
Bypassing WAFs
COMMANDS
Proxy > Intercept > On
Modify requests/responses dynamically
Reporting
Generating Reports
COMMANDS
Project options > Reporting > Generate report
Quick Reference Table
| Flag | Description |
|---|---|
| -I | Include internal links |
| -R | Recurse into directories |
Pro Tips
- Importing Burp Extensions: Utilize the BApp Store within Burp to enhance functionality with plugins such as Turbo Intruder for faster attacks.
- Session Handling: Configure session handling rules to maintain authenticated sessions during your tests.
- Target Scope: Always set your target scope to avoid scanning unintended sites.
Real-World Examples
Example of using Intruder to perform a brute force attack on a login form:
COMMANDS
Intruder > Positions > Clear > Add (to identify form fields)
Payloads > Load list of usernames and passwords
Example of using the Scanner to identify SQL Injection vulnerabilities:
COMMANDS
Target > Right click on URL > Active Scan