Burp Suite allows administrators to intercept and manipulate HTTP/HTTPS traffic to web applications before it is sent to the server. This allows security vulnerabilities in web applications to be discovered quickly and effectively.
Finding vulnerabilities in web applications with Burp Suite
Web applications need to be tested regularly for security vulnerabilities. Some automation is useful here, as it creates an ongoing process for securing applications. The Burp Suite from the company Portswigger can be used to find the best-known vulnerabilities in web applications. These include SQL injection or cross-site scripting (XSS). More about the possibilities can be found in the video accompanying this article.
The tool can be installed on Windows computers and is therefore very fast to use. In addition, the tool is also available in the security live DVD Kali. Here, too, the suite can be started with just a few mouse clicks.
Free or professional trial
Burp Suite is available as a free version, but it is significantly limited. If you want to test your web applications permanently, you should work with the Professional edition. This costs 329 euros per year and user. The developers provide the professional edition as a free test version for 14 days. The different editions support different scanning speeds and testers can specify exactly for each device to be examined.
Set up Burp Suite
The installation is quickly completed. After installation, a first project can be started. Scan settings are either loaded from the default configuration, or testers load settings from a configuration file when creating a new project.
After starting the interface, the “Proxy” tab should first be used to check whether the internal proxy is switched on and intercepts data. With “Options” settings for the proxy can be made. Here, for example, you can specify which local port the Burp proxy uses. The “Intercept” tab is used to specify whether Burp should forward the data or interrupt the data traffic for examination.
If now on a PC the computer with the started Burp Suite is entered as proxy in the browser, the complete data traffic is routed through the proxy. By default, the proxy works in “intercept” mode. In this mode, the data is only intercepted but not forwarded. If you click on the “Proxy” tab and then on “Intercept”, the intercept mode can be switched off.
In this case, the Burp proxy will forward all data to the destination. This data can also be seen on the “HTTP history” tab and can be tested for vulnerabilities. This can also be seen by looking at the traffic on the “Proxy” tab and then on “HTTP history”.
Perform scans
Once the environment is prepared, the first scans can be started. For this purpose, the web application in which vulnerabilities are to be searched for is called up in a browser that uses Burp Suite as a proxy server. The modules with which Burp Suite works and can search for vulnerabilities can be seen in the upper area of the window.
Via the “Proxy” tab and then on “HTTP history”, the traffic that clients start via Burp Suite can be seen. The context menu of an entry can be used to connect to a module. To do this, select the “Send to <module>” option.
For example, if the option “Send to Sequencer” is selected via the context menu, Burp marks the module “Sequencer” and with “Start live capture” a live examination can be started.
