---
description: March 12, 2024
---

# Burp Suite: The Basics (Old)

**Task 1: Introduction**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FhTHVpieOFVvvptka4cQZ%2Fimage.png?alt=media&#x26;token=a37a55d7-05a0-4eed-932c-06be713d1533" alt=""><figcaption></figcaption></figure>

**Task 2: Getting Started - What is Burp Suite?**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FW16OIUrfchAdJ2TvcLLg%2Fimage.png?alt=media&#x26;token=d4444b2e-d16a-4e54-b432-89ab0800f655" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FkEF29sk0NE4Si8DTs2JM%2Fimage.png?alt=media&#x26;token=33ba6450-af28-4944-9b34-59e6a4ee38bf" alt=""><figcaption></figcaption></figure>

**Task 3: Getting Started - Features of Burp Community**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FNGBiCBCkRR3mzvV7QX0h%2Fimage.png?alt=media&#x26;token=b4f9f0f7-60cb-4271-92ff-5a313a9c0174" alt=""><figcaption></figcaption></figure>

**Task 4: Getting Started - Installation**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FKEa94pIX4MeTKcr3cDlG%2Fimage.png?alt=media&#x26;token=61d42ceb-809a-4c0f-aa28-9f31fa8fd3e9" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F9TuONRtG6EjP7Ef6E1AQ%2Fimage.png?alt=media&#x26;token=e4904337-4f6a-4cc9-b0b5-34751ec0a353" alt=""><figcaption></figcaption></figure>

**Task 5: Getting Started - The Dashboard**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FwLhDhDnzgDsykN7GzDlc%2Fimage.png?alt=media&#x26;token=69af49b5-86e2-4799-bb20-1441f4ad9f72" alt=""><figcaption></figcaption></figure>

**Task 6: Getting Started - Navigation**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FvmFiRFtTaBrOT9antsSO%2Fimage.png?alt=media&#x26;token=c2cb5c16-3ec5-4186-9df3-141e267625df" alt=""><figcaption></figcaption></figure>

**Task 7: Getting Started - Options**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FubXHaNk4dDb2Ab8wqXPA%2Fimage.png?alt=media&#x26;token=8a296562-f7aa-4eb2-aac7-30b2e8359d0c" alt=""><figcaption></figcaption></figure>

**Task 8: Proxy - Introduction to the Burp Proxy**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FsppaLad61k9Nv4RgUEKt%2Fimage.png?alt=media&#x26;token=b8614386-0f5c-48fb-a56f-7f286414e4d4" alt=""><figcaption></figcaption></figure>

**Task 9: Proxy - Connecting through the Proxy (FoxyProxy)**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FRTyN4fwrsQ6GyBgNnvGt%2Fimage.png?alt=media&#x26;token=745ea917-4ff4-488b-837f-1484dc4d858c" alt=""><figcaption></figcaption></figure>

**Task 10: Proxy - Proxying HTTPS**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FNtCr2ABWxSd42oRzJGd4%2Fimage.png?alt=media&#x26;token=37031cc3-17ca-4de9-a84d-5e5735dd563b" alt=""><figcaption></figcaption></figure>

**Task 11: Proxy - The Burp Suite Browser (Chromium)**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FUYv1x3eLHQYFCzftKXn8%2Fimage.png?alt=media&#x26;token=d82f07a9-5719-45fd-ba4a-8590b5956156" alt=""><figcaption></figcaption></figure>

**Task 12: Proxy - Scoping and Targeting**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F0A30nswCoPEQm1TR4VUy%2Fimage.png?alt=media&#x26;token=fc247e65-c64c-4065-80dd-b0c272a19447" alt=""><figcaption></figcaption></figure>

**Task 13: Proxy - Site Map and issue Definitions**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FeDjpaETNuKk5PMTiSySO%2Fimage.png?alt=media&#x26;token=d3b73b9f-65a0-4288-a4b4-d3e26f7a02fe" alt=""><figcaption></figcaption></figure>

```
http://10.10.78.168/5yjR2GLcoGoij2ZK
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FxG8chvjAImHahD5OhRxr%2Fimage.png?alt=media&#x26;token=d0a42825-d47e-4cc8-acd8-299b653db8ef" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F2DMundSi9XMxzUrKKj61%2Fimage.png?alt=media&#x26;token=452eddf8-814d-4fe2-9b4d-bf4787cb0db2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FcO7yy3eqjG0jXJ4tfFFw%2Fimage.png?alt=media&#x26;token=0ed597b8-62c9-4d17-a480-4bfb65aeeaec" alt=""><figcaption></figcaption></figure>

**Task 14: Practical - Example Attack**

First we have to access the ticketing page of the website or the support page where you will put a valid contact email and the query that you have.&#x20;

When we tried to put the basic XSS in the contact email input box, the system actually automatically removing the code since it have a filter that is blocking the malicious code from being inserted.

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FE69j2P9tSgNxig3eDGdR%2Fimage.png?alt=media&#x26;token=9edf8036-39bb-4183-b9ce-29cd0c9226b1" alt=""><figcaption></figcaption></figure>

Then we just intercepted the request from the website to our burp

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F66Xx2OaSQDmH7vB0KSYW%2Fimage.png?alt=media&#x26;token=96d1946f-d29c-4262-81d3-1cbbf9e16678" alt=""><figcaption></figcaption></figure>

Replacing the original email valid input from our malicious code and we just have to click forward to render it into the webpage

```
<script>alert("Succ3ssful XSS")</script>
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fc64MhLCIJERJ2L9efU2h%2Fimage.png?alt=media&#x26;token=37302349-90fd-4b4c-99e3-d6044da2829b" alt=""><figcaption></figcaption></figure>

As we can see here the XSS attack is successful&#x20;

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FPs9zV5z8tqBWGkr5UFqu%2Fimage.png?alt=media&#x26;token=f843976f-86c1-45af-b2de-9b354b080065" alt=""><figcaption></figcaption></figure>

**Task 15: Conclusion - Room Conclusion**

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F4fzKXhpjNZCj0sbnL0yB%2Fimage.png?alt=media&#x26;token=b4ea9fb5-e089-4764-beb9-c791859b1eb6" alt=""><figcaption></figcaption></figure>
