Instructor: Burp Suite. 2 2
In this lesson, we're going to talk about Burp Suite, 3 3
and Burp Suite is a proprietary interception proxy 4 4
and web application assessment tool. 5 5
Now, that probably brings up the question, 6 6
what is an interception proxy? 7 7
Now, an interception proxy is 8 8
essentially a piece of software 9 9
that sits between the client and the server. 10 10
So essentially, it becomes an on-path attack, 11 11
and this allows the request from the client 12 12
to go through and stop at that proxy, 13 13
and then the responses from the server 14 14
can also be stopped by that proxy. 15 15
By doing this, it can analyze and modify those things 16 16
before they're going from the client to the server 17 17
or from the server to the client. 18 18
Essentially, you are the person in the middle, 19 19
and we use this a lot in security testing. 20 20
Now, Burp Suite is a great tool for this because it allows 21 21
for the automated scanning of vulnerabilities 22 22
and crawling of an application to discover content 23 23
while providing the tools for automating the modification 24 24
of requests and insertion of exploits, 25 25
all while being this interception proxy. 26 26
Now, when you use Burp Suite, 27 27
it is a graphical user interface. 28 28
Burp Suite has a commercially available paid version 29 29
that has a lot of features or a free community version. 30 30
It runs on most operating systems, 31 31
including Windows, Linux, and Mac. 32 32
If you have something like Kali Linux or Parrot OS, 33 33
which are both penetration testing suites, 34 34
they come with Burp Suite already built in. 35 35
Now, Burp Suite, because of this, 36 36
is often used by penetration testers and security analysts 37 37
to test the different web applications. 38 38
Now, for the exam, 39 39
you do not need to know how to use Burp Suite, 40 40
but I want to jump into my lab environment here for a second 41 41
and show you a little bit about how to use Burp Suite 42 42
and what I mean by it being this interception proxy 43 43
right between your client, the web browser, 44 44
and the server you're trying to talk to. 45 45
Now, for the exam, again, 46 46
you do not need to be able to perform the actions 47 47
that I'm going to in this demonstration, 48 48
but I wanted to give you an idea of 49 49
how to get started with a tool like Burp Suite. 50 50
Now, in this demonstration, you're going to notice 51 51
that I'm using Burp Suite's interception proxy function, 52 52
and it's going to be used to capture information 53 53
going between my web browser and a web application. 54 54
This web application is connected to a database 55 55
to be able to get information from it 56 56
and then display it back to the user. 57 57
Now, I'm going to use the information that I capture 58 58
to be able to connect to that SQL database directly 59 59
using another tool called sqlmap, 60 60
and I'm going to use sqlmap to perform an SQL injection. 61 61
So this demonstration, I'm really going to show you 62 62
how we kind of put some of these concepts together. 63 63
Now, this demonstration is one that I also do 64 64
in my PenTest+ course, because over there, 65 65
they need to understand how to use these tools 66 66
to perform these attacks as a pen tester, 67 67
but as an analyst, you need to understand 68 68
how these attacks are performed 69 69
so you can defend against them, 70 70
and that's why I'm showing it to you here as well, 71 71
because all the things that an attacker might do 72 72
against your web apps, 73 73
you're responsible for doing the security testing 74 74
and designing and protecting those web applications too. 75 75
As we said inside the objectives for the CySA+, 76 76
one of those objectives is being able to do pen testing 77 77
because that is one of the job functions 78 78
of a cybersecurity analyst if you happen to be working 79 79
on the red team instead of the blue team. 80 80
Now, if you want to learn more about 81 81
how to use Burp Suite or sqlmap in the real world, 82 82
there are thousands of great videos on YouTube, 83 83
Udemy and other learning sites 84 84
that will give you that in-depth training. 85 85
Again, I'm just going to scratch the surface here, 86 86
and for the exam, you do not need to know 87 87
how to use Burp Suite. 88 88
You just need to know what it is and why it would be used. 89 89
So with that said, let's jump into my lab environment. 90 90
In this lesson, I'm going to show you 91 91
how we use something like Burp Suite, which is a web proxy, 92 92
to grab cookie and session data 93 93
to be able to feed it into an SQL injection. 94 94
So to begin this SQL injection, 95 95
we first need an SQL-injection-vulnerable website 96 96
or database, and so on the left of my screen, 97 97
you can see the Damn Vulnerable Web App version 1.0.7, 98 98
which is being run inside 99 99
the Metasploitable 2 virtual machine. 100 100
My Kali machine is going to make a connection to it, 101 101
which I've done here, to be able to access this website. 102 102
Now, the way this form works is if you put in a user ID, 103 103
for instance, record number 2, and hit Submit, 104 104
back will pop up the first and last name of the person. 105 105
That's all this database interaction is doing for us. 106 106
Now, what I want to do is I want to be able 107 107
to grab that information, 108 108
stop it from being sent to the web server 109 109
from my browser by using my web proxy, 110 110
and then I can capture the data from it that I need. 111 111
To do that, I have to go to my Proxy setting 112 112
inside of Burp Suite, and right now, 113 113
you can see my intercept is on. 114 114
Now I need to configure my web browser 115 115
to actually use that proxy. 116 116
So I'm going to go down to my Preferences, 117 117
and from Preferences we're going to go to Advanced. 118 118
Click on Network, 119 119
and then click on Settings under Connection. 120 120
From here, we can set up the manual proxy, 121 121
and I'm going to use the localhost, 127.0.0.1 on port 8080. 122 122
This will tell it to use my Burp Suite tool. 123 123
So if I go ahead and close that, 124 124
now if I go in and say I want to get record number 3, 125 125
notice when I submit it, 126 126
I don't get the answer back in my web browser 127 127
because my web browser hasn't actually made a connection 128 128
to the web server that's going to give me that information. 129 129
Instead, it sent it to the right, 130 130
over to Burp Suite which has captured it, 131 131
and notice that Burp Suite now has that cookie information 132 132
that I need. 133 133
It tells me the security level. 134 134
It tells me the PHP session ID, 135 135
and I'm going to be able to use that as part of my attack 136 136
against this web server. 137 137
So the first thing I want to do is 138 138
I want to capture some of this information. 139 139
First, I need to know the website 140 140
that we were trying to go to. 141 141
So I'm going to go ahead and copy that, 142 142
and I'm going to go ahead and go into my terminal, 143 143
and so what we're going to do is we're going to use sqlmap -u, 144 144
and we're going to provide the website that we're going to. 145 145
So I'm just going to paste that in, 146 146
and then I'm going to use --cookie=, 147 147
and I'm going to copy the information from my cookie. 148 148
So let me go ahead and bring that back over to Burp Suite, 149 149
and we will copy this cookie information, 150 150
and then we will paste that in, 151 151
and from there, we're going to go ahead and hit Enter. 152 152
So at this point, it's going to start querying the database. 153 153
The first thing it notices is 154 154
that this is an MySQL database. 155 155
So it's asking do I want to skip all the test payloads 156 156
for other databases, and in this case, 157 157
we're going to just use the default of yes, and it's going to say, 158 158
"Do you want to include all of the tests for MySQL?" 159 159
And we'll go ahead and say yes, 160 160
and it's going to go through and start querying that database 161 161
and trying to do different injections. 162 162
So you'll notice here that it is trying to do 163 163
different testing based on the version of MySQL, 164 164
trying to do things that are stacked queries 165 165
and other errors to figure out what this is vulnerable to. 166 166
So now it finds that it found an ID parameter 167 167
that was vulnerable, that said id=2 or id=3. 168 168
Do we want to keep testing others? 169 169
We'll go ahead and say no 'cause we already found 170 170
a way into this database, 171 171
and now we're going to see everything that it found. 172 172
So if I go ahead and scroll up a little bit, 173 173
we find that the GET id is vulnerable. 174 174
We also found that it was vulnerable 175 175
based on a boolean-based blind, 176 176
it was vulnerable based on an AND/OR time-based blind, 177 177
and it was vulnerable based on a UNION query. 178 178
We also were able to find out 179 179
that the web server was Linux Ubuntu 8.04. 180 180
We found the version of Apache, the version of PHP, 181 181
and the version of this database, 182 182
and all that information is now saved to this file 183 183
as shown in green on the screen, 184 184
but that really didn't give me a lot of details yet 185 185
that I want to use. 186 186
It just tells me information about our target, 187 187
and so now what I want to do is 188 188
I want to enumerate the databases. 189 189
So I'm going to add a --dbs at the end and hit Enter. 190 190
This is going to go through and find what databases 191 191
are on that server. 192 192
Notice it found seven databases: 193 193
dvwa, information_schema, metasploit, mysql, 194 194
owasp10, tikiwiki, and tikiwi195. 195 195
Now, the one we want to target here is the dvwa, 196 196
the Damn Vulnerable Web App, 197 197
and so now that we know what database we want to target, 198 198
which is the dvwa, I want to select that database 199 199
with my command, so I'm going to go arrow up again, 200 200
go Backspace, put a capital -D, which stands for database, 201 201
and the database I want to select, 202 202
and then I want to enumerate it for the tables 203 203
to figure out what tables exist inside that database. 204 204
So I'm going to put --tables, 205 205
and that will tell me what tables are associated with it. 206 206
Go and hit Enter, and it goes through and scans, 207 207
and it finds two tables, guestbook and users. 208 208
So now I want to be able to dump the columns 209 209
from those tables. 210 210
Again, I went from the database down to the table. 211 211
Now I want to dig in a little bit further 212 212
and get those columns. 213 213
So to do that, we're going to arrow up. 214 214
We're going to Backspace out of tables and do -T 215 215
and give it the table we want, which is users, 216 216
and then --columns, and off we go. 217 217
We now have six columns: the user, avatar, 218 218
first_name, last_name, password, and user_id. 219 219
Wouldn't it be great if we can get those passwords 220 220
for those users? 221 221
I think it would, so let's go a little bit further here, 222 222
and what we're going to do is arrow up. 223 223
Take out the word columns and put in the word dump, 224 224
and here we go. 225 225
Do we want to save this hashes to a temporary file? 226 226
We'll say no, and what it's doing is 227 227
it's grabbing any password hashes from the password column, 228 228
and it's going to attempt to do a dictionary attack 229 229
to crack them, and then we're just going to go ahead 230 230
and use the standard default dictionary of number 1, 231 231
and do we want to use common suffixes? 232 232
No, we're just going to use the default things, 233 233
and it's grabbed those hashes, 234 234
and it's already starting to crack those passwords. 235 235
Notice that I already have a password for charley 236 236
and abc1 and password and letmein, 237 237
and here it is on the screen, 238 238
and so you can see that the first user_id is admin 239 239
and their password in parentheses is password. 240 240
The second user is gordonb, and his password was abc123. 241 241
The third username was 1337, and their password was charley. 242 242
The fourth was Pablo with letmein, 243 243
and the fifth was Smitty with password. 244 244
Again, these were all very simple passwords 245 245
and easy to crack, but you can see the power 246 246
of an SQL injection. 247 247
We can interact directly with that database 248 248
because we've been able to break through the PHP front end 249 249
and be able to inject into the database 250 250
and get information back 251 251
that we shouldn't be able to get back, 252 252
and because sqlmap is such an easy to use program, 253 253
it makes our injections very automated and very easy to use.