Cheatsheets

Burp Suite Essentials: A Security Tool Cheatsheet for Penetration Testers

by n8n admin

📱 Mobile Security Tips

Mike Torres — Android Security Engineer

What is Burp Suite?

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools allow security analysts and penetration testers to conduct assessments ranging from initial mapping and analysis of application attack surfaces to finding and exploiting vulnerabilities.

Installation

Burp Suite can be downloaded from the official PortSwigger website. It is available in different editions, including Community (free), Professional, and Enterprise. Installation is straightforward and usually involves downloading the installer and running it on your system.

Basic Syntax

The basic usage of Burp Suite involves launching the application and configuring your web browser to work with it. You generally will configure your browser to use Burp as a proxy (default is 127.0.0.1:8080).

Discovery

Finding URLs and Hidden Content

COMMANDS
Intruder > Target > Add (to define your target)
Site map > Right click > Spider this site

Scanning

Active Scan

COMMANDS
Target > Scope > Add URL to scope
Scanner > Right click on target > Active scan

Exploitation

Using Intruder for Attacks

COMMANDS
Intruder > Positions > Clear > Add payload positions
Intruder > Payloads > Select type (e.g., Simple list, Numbers)

Analysis

Reviewing Issues

COMMANDS
Dashboard > Issues tab > View reported issues

Evasion

Bypassing WAFs

COMMANDS
Proxy > Intercept > On
Modify requests/responses dynamically

Reporting

Generating Reports

COMMANDS
Project options > Reporting > Generate report

Quick Reference Table

Flag Description
-I Include internal links
-R Recurse into directories

Pro Tips

  • Importing Burp Extensions: Utilize the BApp Store within Burp to enhance functionality with plugins such as Turbo Intruder for faster attacks.
  • Session Handling: Configure session handling rules to maintain authenticated sessions during your tests.
  • Target Scope: Always set your target scope to avoid scanning unintended sites.

Real-World Examples

Example of using Intruder to perform a brute force attack on a login form:

COMMANDS
Intruder > Positions > Clear > Add (to identify form fields)
Payloads > Load list of usernames and passwords

Example of using the Scanner to identify SQL Injection vulnerabilities:

COMMANDS
Target > Right click on URL > Active Scan

Related Posts