Lozano Carlos A - Hands-on application penetration testing with Burp Suite use Burp Suite and its features to inspect, detect, and exploit security vulnerabilities in your web applications

• Spend less time learning and more time coding with practical eBooks and Videos from over 4,000 industry professionals

• Improve your learning with Skill Plans built especially for you

• Get a free eBook or video every month

• Mapt is fully searchable

• Copy and paste, print, and bookmark content

, Configuring Burp Suite , takes us through preparing the system that will be used to attack the end application, before starting the actual application penetration test. This involves configuring Burp Suite to become the interception proxy for various clients and traffic sources.

, Configuring the Client and Setting Up Mobile Devices , will look at the three most popular user agents (Firefox, Chrome, and Internet Explorer) and configure them to work in tandem with the Burp Suite configuration, which we created, to be able to intercept HTTP and HTTPS traffic. We will also set the system proxy in the Windows, Linux, and macOS X operating systems for non-proxy aware clients. Before beginning an application penetration test, we must be aware of the scope and target that we intend to attack. To ensure that our attack traffic is sent to the right target, and to prevent unnecessary clutter and noise during the testing, we can configure Burp Suite to work with specific scopes.

, Executing an Application Penetration Test, uses an example web application to look at how a lot of security professionals jump to attacking the application without context, without understanding the application, and without scoping the target properly. We will look at the common areas that get overlooked due to this non-standard approach to penetration testing, and build the background for a staged approach to application penetration testing.

, Exploring the Stages of an Application Penetration Test , outlines the stages that are involved in the application penetration test and provides a wide overview of Burp Suite tools. Based on that knowledge, we are going to enumerate and gather information about our target.

, Preparing for an Application Penetration Test , details the key stages of an application penetration test performed to successfully meet the desired objectives of an engagement. Each of these stages produces data that can be used to progress to the next stage, until the desired set objective is met. The various stages of an application penetration test, namely reconnaissance, scanning, exploitation, and reporting, are covered in this chapter.

, Identifying Vulnerabilities Using Burp Suite , explains how various features of Burp Suite can be used to detect various vulnerabilities as part of an application penetration test. We will cover the detection of vulnerabilities, such as SQL injections, OS command injection, Cross-Site Scripting (XSS) vulnerabilities, XML-related issues, XML external entity processing, Server-Side Template Injection (SSTI), and Server-Side Request Forgery/Cross-Site Port Attacks (SSRF/XSPA).

, Detecting Vulnerabilities Using Burp Suite , details how various features of Burp Suite can be used to detect additional vulnerabilities as part of an application penetration test. We will cover the detection of vulnerabilities, including Cross-Site Request Forgery (CSRF), insecure direct object references, issues arising out of security misconfiguration, weaknesses with deserialization, authentication issues surrounding OAuth (aside from generic authentication issues), issues regarding poor authorization implementations, and the detection of padding oracle attacks.

, Exploiting Vulnerabilities Using Burp Suite Part 1 , explains how, once detection is completed and the vulnerability is confirmed, it is time to exploit the vulnerability. The goal of the exploitation phase is to either gain access to data the application uses/protects, to gain access to the underlying operating system, to gain access to the accounts of other users, or any combination of these. In this chapter, we shall see how Burp Suite's various features can be used to exploit a detected vulnerability to fulfill the objective of the penetration test, or simply to generate a proof of concept to be used in the reporting phase.