Burp Suite Cookbook: Web application security made easy with Burp Suite [2 ed.] 9781835081075

Table of contents :
Burp Suite Cookbook
Contributors
About the author
About the reviewer
Preface
Who this book is for
What this book covers
To get the most out of this book
Conventions used
Sections
Getting ready
How to do it…
How it works…
There’s more…
See also
Get in touch
Share your thoughts
Download a free PDF copy of this book
1
Getting Started with Burp Suite
Downloading Burp Suite (Community and Professional editions)
Getting ready
How to do it...
Setting up a web app pentesting lab
Getting ready
How to do it...
How it works…
Creating a PortSwigger account to access Web Security Academy
Getting ready
How to do it…
Starting Burp Suite at a command line or as an executable
How to do it...
How it works...
Listening for HTTP traffic using Burp
Getting ready
How to do it...
How it works...
There’s more…
2
Getting to Know the Burp Suite of Tools
Technical requirements
Setting the Target Site Map
Getting ready
How to do it...
How it works...
Understanding the message editor
Getting ready
How to do it...
Repeating with Repeater
Getting ready
How to do it...
Decoding with Decoder
Getting ready
How to do it...
There’s more...
Intruding with Intruder
Getting ready
How to do it...
3
Configuring, Crawling, Auditing, and Reporting with Burp
Technical requirements
Establishing trust over HTTPS
Getting ready
How to do it...
There’s more...
Setting project configurations
How to do it…
Setting user configurations
How to do it…
How it works…
There’s more...
Crawling target sites
Getting ready
How to do it...
Creating a custom scan script
Getting ready
How to do it...
There’s more...
Reporting issues
Getting ready
How to do it...
4
Assessing Authentication Schemes
Technical requirements
Testing for account enumeration and guessable accounts
Getting ready
How to do it...
Testing for weak lockout mechanisms
Getting ready
How to do it...
Testing for bypassing authentication schemes
Getting ready
How to do it...
How it works…
Testing for browser cache weaknesses
Getting ready
How to do it...
How it works…
Testing the account provisioning process via the REST API
Getting ready
How to do it...
How it works…
5
Assessing Authorization Checks
Technical requirements
Testing for directory traversal
Getting ready
How to do it...
How it works...
Testing for LFI
Getting ready
How to do it...
How it works...
Testing for RFI
Getting ready
How to do it...
How it works...
Testing for privilege escalation
Getting ready
How to do it...
How it works...
Testing for IDOR
Getting ready
How to do it...
How it works...
6
Assessing Session Management Mechanisms
Technical requirements
Testing session token strength using Sequencer
Getting ready
How to do it...
How it works...
Testing for cookie attributes
Getting ready
How to do it...
How it works...
Testing for session fixation
Getting ready
How to do it...
How it works...
Testing for exposed session variables
Getting ready
How to do it...
How it works...
Testing for cross-site request forgery
Getting ready
How to do it...
How it works...
7
Assessing Business Logic
Technical requirements
Testing business logic data validation
Getting ready
How to do it...
How it works...
Unrestricted file upload – bypassing weak validation
Getting ready
How to do it...
How it works...
Performing process-timing attacks
Getting ready
How to do it...
How it works...
There’s more...
Testing for the circumvention of workflows
Getting ready
How to do it...
How it works...
Uploading malicious files – polyglots
Getting ready
How to do it...
How it works...
There’s more...
8
Evaluating Input Validation Checks
Technical requirements
Testing for reflected cross-site scripting
Getting ready
How to do it...
How it works...
Testing for stored cross-site scripting
Getting ready
How to do it...
How it works...
Testing for HTTP verb tampering
Getting ready
How to do it...
How it works...
Testing for HTTP parameter pollution
Getting ready
How to do it...
How it works...
Testing for SQL injection
Getting ready
How to do it...
How it works...
There’s more...
Testing for command injection
Getting ready
How to do it...
How it works...
9
Attacking the Client
Technical requirements
Testing for clickjacking
Getting ready
How to do it...
How it works...
Testing for DOM-based cross-site scripting
Getting ready
How to do it...
How it works...
Leveraging DOM Invader for testing DOM XSS
Getting ready
How to do it...
How it works...
There’s more...
Testing for JavaScript execution
Getting ready
How to do it...
How it works...
Testing for HTML injection
Getting ready
How to do it...
How it works...
Testing for client-side resource manipulation
Getting ready
How to do it...
How it works...
10
Working with Burp Suite Macros and Extensions
Technical requirements
Creating session-handling macros
Getting ready
How to do it...
How it works...
Getting caught in the cookie jar
Getting ready
How to do it...
How it works...
Adding great pentester plugins
Getting ready
How to do it...
How it works...
Creating new issues via the Add & Track Custom Issues extension
Getting ready
How to do it...
How it works...
See also
Working with the Active Scan++ extension
Getting ready
How to do it...
How it works...
Using Burp Suite extensions for bug bounties
Getting ready
How to do it...
How it works...
11
Implementing Advanced Topic Attacks
Technical requirements
Performing XXE attacks
Getting ready
How to do it...
How it works...
Working with JWTs
Getting ready
How to do it...
How it works...
Using Burp Suite Collaborator to determine SSRF
Getting ready
How to do it...
How it works...
See also
Testing CORS
Getting ready
How to do it...
How it works...
See also
Performing Java deserialization attacks
Getting ready
How to do it...
How it works...
Hacking GraphQL using Burp Suite
Getting ready
How to do it...
How it works...
There’s more...
Index
Why subscribe?
Other Books You May Enjoy
Packt is searching for authors like you
Share your thoughts
Download a free PDF copy of this book

Polecaj historie

Burp Suite Cookbook: Web application security made easy with Burp Suite [2 ed.] 183508107X, 9781835081075

Find and fix security vulnerabilities in your web applications with Burp Suite Key FeaturesSet up and optimize Burp Suit

541 146 108MB Read more

Burp Suite Cookbook

The purpose of the Burp Suite Cookbook is to provide web application penetration testers with hands-on examples of how t

1,566 151 31MB Read more

Burp Suite cookbook practical recipes to help you master web penetration testing with Burp Suite 9781789531732, 178953173X, 9781789539271, 1789539277

Get hands-on experience in using Burp Suite to execute attacks and perform web assessments Key Features Explore the tool

110 26 51MB Read more

Hands-on application penetration testing with Burp Suite use Burp Suite and its features to inspect, detect, and exploit security vulnerabilities in your web applications 9781788995283, 1788995287

Test, fuzz, and break web applications and services using Burp Suite’s powerful capabilitiesKey Features Master the skil

98 64 16MB Read more

Burp Suite 实战指南

2,452 112 16MB Read more

Burp Suite 使用说明

720 156 5MB Read more

Practical Web Penetration Testing: Secure Web Applications Using Burp Suite, Nmap, Metasploit, and More 1788624033, 9781788624039

Learn how to execute web application penetration testing end-to-end Key Features Build an end-to-end threat model landsc

118 61 16MB Read more

A Complete Guide to Burp Suite : Learn to Detect Application Vulnerabilities [1st ed.] 9781484264010, 9781484264027

Use this comprehensive guide to learn the practical aspects of Burp Suite—from the basics to more advanced topics. The b

3,917 450 9MB Read more

Полное руководство по Burp Suite [1 ed.] 1484264010, 9781484264010

“Use this comprehensive guide to learn the practical aspects of Burp Suite—from the basics to more advanced topics. The

192 86 15MB Read more

Lexique de suite bureautique

511 85 73MB Read more