1 1 00:00:00,300 --> 00:00:01,590 Burp Suite. 2 2 00:00:01,590 --> 00:00:04,290 In this lesson, we're going to talk about Burp Suite, 3 3 00:00:04,290 --> 00:00:06,990 and Burp Suite is a proprietary interception proxy 4 4 00:00:06,990 --> 00:00:09,180 and web application assessment tool. 5 5 00:00:09,180 --> 00:00:10,890 Now, that probably brings up the question, 6 6 00:00:10,890 --> 00:00:13,230 what is an interception proxy? 7 7 00:00:13,230 --> 00:00:14,520 Now, an interception proxy is 8 8 00:00:14,520 --> 00:00:16,020 essentially a piece of software 9 9 00:00:16,020 --> 00:00:18,180 that sits between the client and the server. 10 10 00:00:18,180 --> 00:00:20,610 So essentially, it becomes an on-path attack, 11 11 00:00:20,610 --> 00:00:22,530 and this allows the request from the client 12 12 00:00:22,530 --> 00:00:25,110 to go through and stop at that proxy, 13 13 00:00:25,110 --> 00:00:26,640 and then the responses from the server 14 14 00:00:26,640 --> 00:00:28,740 can also be stopped by that proxy. 15 15 00:00:28,740 --> 00:00:31,650 By doing this, it can analyze and modify those things 16 16 00:00:31,650 --> 00:00:33,540 before they're going from the client to the server 17 17 00:00:33,540 --> 00:00:35,340 or from the server to the client. 18 18 00:00:35,340 --> 00:00:37,140 Essentially, you are the person in the middle, 19 19 00:00:37,140 --> 00:00:39,660 and we use this a lot in security testing. 20 20 00:00:39,660 --> 00:00:42,180 Now, Burp Suite is a great tool for this because it allows 21 21 00:00:42,180 --> 00:00:43,950 for the automated scanning of vulnerabilities 22 22 00:00:43,950 --> 00:00:46,800 and crawling of an application to discover content 23 23 00:00:46,800 --> 00:00:49,440 while providing the tools for automating the modification 24 24 00:00:49,440 --> 00:00:51,660 of requests and insertion of exploits, 25 25 00:00:51,660 --> 00:00:54,120 all while being this interception proxy. 26 26 00:00:54,120 --> 00:00:55,470 Now, when you use Burp Suite, 27 27 00:00:55,470 --> 00:00:57,540 it is a graphical user interface. 28 28 00:00:57,540 --> 00:00:59,850 Burp Suite has a commercially available paid version 29 29 00:00:59,850 --> 00:01:03,180 that has a lot of features or a free community version. 30 30 00:01:03,180 --> 00:01:04,920 It runs on most operating systems, 31 31 00:01:04,920 --> 00:01:07,590 including Windows, Linux, and Mac. 32 32 00:01:07,590 --> 00:01:10,020 If you have something like Kali Linux or Parrot OS, 33 33 00:01:10,020 --> 00:01:12,000 which are both penetration testing suites, 34 34 00:01:12,000 --> 00:01:14,460 they come with Burp Suite already built in. 35 35 00:01:14,460 --> 00:01:15,900 Now, Burp Suite, because of this, 36 36 00:01:15,900 --> 00:01:19,080 is often used by penetration testers and security analysts 37 37 00:01:19,080 --> 00:01:21,420 to test the different web applications. 38 38 00:01:21,420 --> 00:01:22,980 Now, for the exam, 39 39 00:01:22,980 --> 00:01:25,560 you do not need to know how to use Burp Suite, 40 40 00:01:25,560 --> 00:01:28,410 but I want to jump into my lab environment here for a second 41 41 00:01:28,410 --> 00:01:30,720 and show you a little bit about how to use Burp Suite 42 42 00:01:30,720 --> 00:01:33,300 and what I mean by it being this interception proxy 43 43 00:01:33,300 --> 00:01:35,880 right between your client, the web browser, 44 44 00:01:35,880 --> 00:01:38,010 and the server you're trying to talk to. 45 45 00:01:38,010 --> 00:01:39,240 Now, for the exam, again, 46 46 00:01:39,240 --> 00:01:41,250 you do not need to be able to perform the actions 47 47 00:01:41,250 --> 00:01:43,020 that I'm going to in this demonstration, 48 48 00:01:43,020 --> 00:01:44,190 but I wanted to give you an idea of 49 49 00:01:44,190 --> 00:01:46,500 how to get started with a tool like Burp Suite. 50 50 00:01:46,500 --> 00:01:48,630 Now, in this demonstration, you're going to notice 51 51 00:01:48,630 --> 00:01:51,540 that I'm using Burp Suite's interception proxy function, 52 52 00:01:51,540 --> 00:01:53,490 and it's going to be used to capture information 53 53 00:01:53,490 --> 00:01:56,700 going between my web browser and a web application. 54 54 00:01:56,700 --> 00:01:59,100 This web application is connected to a database 55 55 00:01:59,100 --> 00:02:00,510 to be able to get information from it 56 56 00:02:00,510 --> 00:02:02,520 and then display it back to the user. 57 57 00:02:02,520 --> 00:02:04,950 Now, I'm going to use the information that I capture 58 58 00:02:04,950 --> 00:02:07,440 to be able to connect to that SQL database directly 59 59 00:02:07,440 --> 00:02:10,050 using another tool called sqlmap, 60 60 00:02:10,050 --> 00:02:13,530 and I'm going to use sqlmap to perform an SQL injection. 61 61 00:02:13,530 --> 00:02:15,660 So this demonstration, I'm really going to show you 62 62 00:02:15,660 --> 00:02:18,120 how we kind of put some of these concepts together. 63 63 00:02:18,120 --> 00:02:20,070 Now, this demonstration is one that I also do 64 64 00:02:20,070 --> 00:02:22,530 in my PenTest+ course, because over there, 65 65 00:02:22,530 --> 00:02:24,360 they need to understand how to use these tools 66 66 00:02:24,360 --> 00:02:26,940 to perform these attacks as a pen tester, 67 67 00:02:26,940 --> 00:02:29,220 but as an analyst, you need to understand 68 68 00:02:29,220 --> 00:02:30,570 how these attacks are performed 69 69 00:02:30,570 --> 00:02:32,130 so you can defend against them, 70 70 00:02:32,130 --> 00:02:34,140 and that's why I'm showing it to you here as well, 71 71 00:02:34,140 --> 00:02:35,760 because all the things that an attacker might do 72 72 00:02:35,760 --> 00:02:37,080 against your web apps, 73 73 00:02:37,080 --> 00:02:39,390 you're responsible for doing the security testing 74 74 00:02:39,390 --> 00:02:42,300 and designing and protecting those web applications too. 75 75 00:02:42,300 --> 00:02:45,000 As we said inside the objectives for the CySA+, 76 76 00:02:45,000 --> 00:02:47,820 one of those objectives is being able to do pen testing 77 77 00:02:47,820 --> 00:02:49,500 because that is one of the job functions 78 78 00:02:49,500 --> 00:02:52,170 of a cybersecurity analyst if you happen to be working 79 79 00:02:52,170 --> 00:02:54,990 on the red team instead of the blue team. 80 80 00:02:54,990 --> 00:02:56,250 Now, if you want to learn more about 81 81 00:02:56,250 --> 00:02:59,460 how to use Burp Suite or sqlmap in the real world, 82 82 00:02:59,460 --> 00:03:02,280 there are thousands of great videos on YouTube, 83 83 00:03:02,280 --> 00:03:04,080 Udemy and other learning sites 84 84 00:03:04,080 --> 00:03:06,060 that will give you that in-depth training. 85 85 00:03:06,060 --> 00:03:08,550 Again, I'm just going to scratch the surface here, 86 86 00:03:08,550 --> 00:03:10,530 and for the exam, you do not need to know 87 87 00:03:10,530 --> 00:03:11,820 how to use Burp Suite. 88 88 00:03:11,820 --> 00:03:14,730 You just need to know what it is and why it would be used. 89 89 00:03:14,730 --> 00:03:17,613 So with that said, let's jump into my lab environment. 90 90 00:03:18,480 --> 00:03:19,860 In this lesson, I'm going to show you 91 91 00:03:19,860 --> 00:03:23,250 how we use something like Burp Suite, which is a web proxy, 92 92 00:03:23,250 --> 00:03:25,800 to grab cookie and session data 93 93 00:03:25,800 --> 00:03:29,220 to be able to feed it into an SQL injection. 94 94 00:03:29,220 --> 00:03:31,320 So to begin this SQL injection, 95 95 00:03:31,320 --> 00:03:34,560 we first need an SQL-injection-vulnerable website 96 96 00:03:34,560 --> 00:03:37,200 or database, and so on the left of my screen, 97 97 00:03:37,200 --> 00:03:40,083 you can see the Damn Vulnerable Web App version 1.0.7, 98 98 00:03:41,353 --> 00:03:42,960 which is being run inside 99 99 00:03:42,960 --> 00:03:45,390 the Metasploitable 2 virtual machine. 100 100 00:03:45,390 --> 00:03:47,880 My Kali machine is going to make a connection to it, 101 101 00:03:47,880 --> 00:03:51,450 which I've done here, to be able to access this website. 102 102 00:03:51,450 --> 00:03:54,570 Now, the way this form works is if you put in a user ID, 103 103 00:03:54,570 --> 00:03:57,990 for instance, record number 2, and hit Submit, 104 104 00:03:57,990 --> 00:04:01,230 back will pop up the first and last name of the person. 105 105 00:04:01,230 --> 00:04:04,080 That's all this database interaction is doing for us. 106 106 00:04:04,080 --> 00:04:06,060 Now, what I want to do is I want to be able 107 107 00:04:06,060 --> 00:04:07,650 to grab that information, 108 108 00:04:07,650 --> 00:04:10,230 stop it from being sent to the web server 109 109 00:04:10,230 --> 00:04:13,050 from my browser by using my web proxy, 110 110 00:04:13,050 --> 00:04:16,020 and then I can capture the data from it that I need. 111 111 00:04:16,020 --> 00:04:19,290 To do that, I have to go to my Proxy setting 112 112 00:04:19,290 --> 00:04:21,990 inside of Burp Suite, and right now, 113 113 00:04:21,990 --> 00:04:25,050 you can see my intercept is on. 114 114 00:04:25,050 --> 00:04:27,330 Now I need to configure my web browser 115 115 00:04:27,330 --> 00:04:29,130 to actually use that proxy. 116 116 00:04:29,130 --> 00:04:31,080 So I'm going to go down to my Preferences, 117 117 00:04:32,850 --> 00:04:35,670 and from Preferences we're going to go to Advanced. 118 118 00:04:35,670 --> 00:04:36,810 Click on Network, 119 119 00:04:36,810 --> 00:04:39,420 and then click on Settings under Connection. 120 120 00:04:39,420 --> 00:04:41,970 From here, we can set up the manual proxy, 121 121 00:04:41,970 --> 00:04:46,970 and I'm going to use the localhost, 127.0.0.1 on port 8080. 122 122 00:04:47,100 --> 00:04:50,310 This will tell it to use my Burp Suite tool. 123 123 00:04:50,310 --> 00:04:52,110 So if I go ahead and close that, 124 124 00:04:52,110 --> 00:04:55,500 now if I go in and say I want to get record number 3, 125 125 00:04:55,500 --> 00:04:56,640 notice when I submit it, 126 126 00:04:56,640 --> 00:04:59,040 I don't get the answer back in my web browser 127 127 00:04:59,040 --> 00:05:01,440 because my web browser hasn't actually made a connection 128 128 00:05:01,440 --> 00:05:04,260 to the web server that's going to give me that information. 129 129 00:05:04,260 --> 00:05:06,330 Instead, it sent it to the right, 130 130 00:05:06,330 --> 00:05:08,790 over to Burp Suite which has captured it, 131 131 00:05:08,790 --> 00:05:12,090 and notice that Burp Suite now has that cookie information 132 132 00:05:12,090 --> 00:05:12,960 that I need. 133 133 00:05:12,960 --> 00:05:14,610 It tells me the security level. 134 134 00:05:14,610 --> 00:05:16,830 It tells me the PHP session ID, 135 135 00:05:16,830 --> 00:05:19,320 and I'm going to be able to use that as part of my attack 136 136 00:05:19,320 --> 00:05:21,000 against this web server. 137 137 00:05:21,000 --> 00:05:22,320 So the first thing I want to do is 138 138 00:05:22,320 --> 00:05:23,760 I want to capture some of this information. 139 139 00:05:23,760 --> 00:05:25,680 First, I need to know the website 140 140 00:05:25,680 --> 00:05:26,610 that we were trying to go to. 141 141 00:05:26,610 --> 00:05:28,590 So I'm going to go ahead and copy that, 142 142 00:05:28,590 --> 00:05:31,410 and I'm going to go ahead and go into my terminal, 143 143 00:05:31,410 --> 00:05:35,220 and so what we're going to do is we're going to use sqlmap -u, 144 144 00:05:35,220 --> 00:05:37,650 and we're going to provide the website that we're going to. 145 145 00:05:37,650 --> 00:05:39,990 So I'm just going to paste that in, 146 146 00:05:39,990 --> 00:05:43,853 and then I'm going to use --cookie=, 147 147 00:05:44,790 --> 00:05:47,580 and I'm going to copy the information from my cookie. 148 148 00:05:47,580 --> 00:05:50,670 So let me go ahead and bring that back over to Burp Suite, 149 149 00:05:50,670 --> 00:05:53,973 and we will copy this cookie information, 150 150 00:05:58,590 --> 00:06:00,153 and then we will paste that in, 151 151 00:06:05,580 --> 00:06:08,493 and from there, we're going to go ahead and hit Enter. 152 152 00:06:10,620 --> 00:06:13,140 So at this point, it's going to start querying the database. 153 153 00:06:13,140 --> 00:06:14,250 The first thing it notices is 154 154 00:06:14,250 --> 00:06:16,200 that this is an MySQL database. 155 155 00:06:16,200 --> 00:06:18,810 So it's asking do I want to skip all the test payloads 156 156 00:06:18,810 --> 00:06:20,640 for other databases, and in this case, 157 157 00:06:20,640 --> 00:06:23,617 we're going to just use the default of yes, and it's going to say, 158 158 00:06:23,617 --> 00:06:26,010 "Do you want to include all of the tests for MySQL?" 159 159 00:06:26,010 --> 00:06:27,990 And we'll go ahead and say yes, 160 160 00:06:27,990 --> 00:06:30,690 and it's going to go through and start querying that database 161 161 00:06:30,690 --> 00:06:33,270 and trying to do different injections. 162 162 00:06:33,270 --> 00:06:35,550 So you'll notice here that it is trying to do 163 163 00:06:35,550 --> 00:06:38,670 different testing based on the version of MySQL, 164 164 00:06:38,670 --> 00:06:41,070 trying to do things that are stacked queries 165 165 00:06:41,070 --> 00:06:44,430 and other errors to figure out what this is vulnerable to. 166 166 00:06:44,430 --> 00:06:47,100 So now it finds that it found an ID parameter 167 167 00:06:47,100 --> 00:06:50,820 that was vulnerable, that said id=2 or id=3. 168 168 00:06:50,820 --> 00:06:51,990 Do we want to keep testing others? 169 169 00:06:51,990 --> 00:06:53,760 We'll go ahead and say no 'cause we already found 170 170 00:06:53,760 --> 00:06:55,203 a way into this database, 171 171 00:06:56,610 --> 00:06:58,890 and now we're going to see everything that it found. 172 172 00:06:58,890 --> 00:07:01,090 So if I go ahead and scroll up a little bit, 173 173 00:07:03,480 --> 00:07:05,760 we find that the GET id is vulnerable. 174 174 00:07:05,760 --> 00:07:07,500 We also found that it was vulnerable 175 175 00:07:07,500 --> 00:07:09,360 based on a boolean-based blind, 176 176 00:07:09,360 --> 00:07:12,540 it was vulnerable based on an AND/OR time-based blind, 177 177 00:07:12,540 --> 00:07:15,210 and it was vulnerable based on a UNION query. 178 178 00:07:15,210 --> 00:07:16,500 We also were able to find out 179 179 00:07:16,500 --> 00:07:19,920 that the web server was Linux Ubuntu 8.04. 180 180 00:07:19,920 --> 00:07:22,770 We found the version of Apache, the version of PHP, 181 181 00:07:22,770 --> 00:07:25,020 and the version of this database, 182 182 00:07:25,020 --> 00:07:28,110 and all that information is now saved to this file 183 183 00:07:28,110 --> 00:07:29,763 as shown in green on the screen, 184 184 00:07:30,600 --> 00:07:33,420 but that really didn't give me a lot of details yet 185 185 00:07:33,420 --> 00:07:34,320 that I want to use. 186 186 00:07:34,320 --> 00:07:37,140 It just tells me information about our target, 187 187 00:07:37,140 --> 00:07:38,520 and so now what I want to do is 188 188 00:07:38,520 --> 00:07:39,960 I want to enumerate the databases. 189 189 00:07:39,960 --> 00:07:44,490 So I'm going to add a --dbs at the end and hit Enter. 190 190 00:07:44,490 --> 00:07:46,620 This is going to go through and find what databases 191 191 00:07:46,620 --> 00:07:48,240 are on that server. 192 192 00:07:48,240 --> 00:07:50,760 Notice it found seven databases: 193 193 00:07:50,760 --> 00:07:55,440 dvwa, information_schema, metasploit, mysql, 194 194 00:07:55,440 --> 00:07:59,520 owasp10, tikiwiki, and tikiwi195. 195 195 00:07:59,520 --> 00:08:02,460 Now, the one we want to target here is the dvwa, 196 196 00:08:02,460 --> 00:08:03,810 the Damn Vulnerable Web App, 197 197 00:08:03,810 --> 00:08:05,970 and so now that we know what database we want to target, 198 198 00:08:05,970 --> 00:08:09,000 which is the dvwa, I want to select that database 199 199 00:08:09,000 --> 00:08:11,850 with my command, so I'm going to go arrow up again, 200 200 00:08:11,850 --> 00:08:16,530 go Backspace, put a capital -D, which stands for database, 201 201 00:08:16,530 --> 00:08:18,420 and the database I want to select, 202 202 00:08:18,420 --> 00:08:20,460 and then I want to enumerate it for the tables 203 203 00:08:20,460 --> 00:08:23,190 to figure out what tables exist inside that database. 204 204 00:08:23,190 --> 00:08:26,220 So I'm going to put --tables, 205 205 00:08:26,220 --> 00:08:28,800 and that will tell me what tables are associated with it. 206 206 00:08:28,800 --> 00:08:31,680 Go and hit Enter, and it goes through and scans, 207 207 00:08:31,680 --> 00:08:35,850 and it finds two tables, guestbook and users. 208 208 00:08:35,850 --> 00:08:38,340 So now I want to be able to dump the columns 209 209 00:08:38,340 --> 00:08:39,173 from those tables. 210 210 00:08:39,173 --> 00:08:41,520 Again, I went from the database down to the table. 211 211 00:08:41,520 --> 00:08:43,170 Now I want to dig in a little bit further 212 212 00:08:43,170 --> 00:08:44,670 and get those columns. 213 213 00:08:44,670 --> 00:08:47,250 So to do that, we're going to arrow up. 214 214 00:08:47,250 --> 00:08:50,610 We're going to Backspace out of tables and do -T 215 215 00:08:50,610 --> 00:08:53,250 and give it the table we want, which is users, 216 216 00:08:53,250 --> 00:08:57,810 and then --columns, and off we go. 217 217 00:08:57,810 --> 00:09:01,830 We now have six columns: the user, avatar, 218 218 00:09:01,830 --> 00:09:04,740 first_name, last_name, password, and user_id. 219 219 00:09:04,740 --> 00:09:06,690 Wouldn't it be great if we can get those passwords 220 220 00:09:06,690 --> 00:09:07,860 for those users? 221 221 00:09:07,860 --> 00:09:11,070 I think it would, so let's go a little bit further here, 222 222 00:09:11,070 --> 00:09:12,870 and what we're going to do is arrow up. 223 223 00:09:12,870 --> 00:09:16,413 Take out the word columns and put in the word dump, 224 224 00:09:18,060 --> 00:09:19,650 and here we go. 225 225 00:09:19,650 --> 00:09:22,140 Do we want to save this hashes to a temporary file? 226 226 00:09:22,140 --> 00:09:24,030 We'll say no, and what it's doing is 227 227 00:09:24,030 --> 00:09:27,120 it's grabbing any password hashes from the password column, 228 228 00:09:27,120 --> 00:09:29,700 and it's going to attempt to do a dictionary attack 229 229 00:09:29,700 --> 00:09:32,280 to crack them, and then we're just going to go ahead 230 230 00:09:32,280 --> 00:09:35,133 and use the standard default dictionary of number 1, 231 231 00:09:36,300 --> 00:09:38,070 and do we want to use common suffixes? 232 232 00:09:38,070 --> 00:09:40,200 No, we're just going to use the default things, 233 233 00:09:40,200 --> 00:09:41,610 and it's grabbed those hashes, 234 234 00:09:41,610 --> 00:09:43,800 and it's already starting to crack those passwords. 235 235 00:09:43,800 --> 00:09:45,870 Notice that I already have a password for charley 236 236 00:09:45,870 --> 00:09:48,870 and abc1 and password and letmein, 237 237 00:09:48,870 --> 00:09:50,850 and here it is on the screen, 238 238 00:09:50,850 --> 00:09:53,430 and so you can see that the first user_id is admin 239 239 00:09:53,430 --> 00:09:56,010 and their password in parentheses is password. 240 240 00:09:56,010 --> 00:09:59,940 The second user is gordonb, and his password was abc123. 241 241 00:09:59,940 --> 00:10:04,110 The third username was 1337, and their password was charley. 242 242 00:10:04,110 --> 00:10:06,240 The fourth was Pablo with letmein, 243 243 00:10:06,240 --> 00:10:08,490 and the fifth was Smitty with password. 244 244 00:10:08,490 --> 00:10:10,140 Again, these were all very simple passwords 245 245 00:10:10,140 --> 00:10:12,600 and easy to crack, but you can see the power 246 246 00:10:12,600 --> 00:10:14,100 of an SQL injection. 247 247 00:10:14,100 --> 00:10:16,290 We can interact directly with that database 248 248 00:10:16,290 --> 00:10:19,710 because we've been able to break through the PHP front end 249 249 00:10:19,710 --> 00:10:21,810 and be able to inject into the database 250 250 00:10:21,810 --> 00:10:23,010 and get information back 251 251 00:10:23,010 --> 00:10:24,930 that we shouldn't be able to get back, 252 252 00:10:24,930 --> 00:10:27,840 and because sqlmap is such an easy to use program, 253 253 00:10:27,840 --> 00:10:31,383 it makes our injections very automated and very easy to use.