Burp Suite Advanced Tutorial

Scope Configuration and Filtering

Proper scope configuration ensures Burp Suite only processes relevant traffic, reducing noise and improving performance during testing.

# Scope Configuration (Target Tab -> Scope)

# Include in scope
^https?://[^/]*.target.com/.*
^https?://api.target.com/.*
^https?://[^/]*.target.com:8080/.*

# Exclude from scope (for performance)
.*.googleapis.com/.*
.*.google-analytics.com/.*
.*.cloudflare.com/.*
.*.CDN.*.com/.*

# Proxy History Filtering
# Use filter bar for quick filtering:
# Show only: In-scope items
# Filter by MIME type: HTML, JSON, XML
# Filter by status code: 2xx, 4xx
# Filter by extensions: .js, .css, .png

# Advanced Filtering
# Params: Highlight parameterized requests
# Annotations: Show manually marked items

Advanced Intruder Techniques

# Credential Spraying with Pitchfork
# Position: username and password parameters

# Payload Set 1: usernames.txt
admin
tester
developer
john
mary

# Payload Set 2: passwords.txt
Password123
Admin@123
Welcome1
Test@123

# Use pitchfork - tests all combinations efficiently
# Monitor for successful login responses

# SQL Injection Fuzzing
# Payload Processing:
# 1. Add prefix: '
# 2. Add suffix: --
# 3. Match-replace with SQL payloads:
' OR '1'='1
' OR 1=1--
" OR "1"="1
' UNION SELECT NULL--
admin'--

# XSS Testing
# Use Burp Intruder with:
# Simple list with XSS payloads
# Processing: URL-encode special chars
<script>alert(1)</script>
<img src=x onerror=alert(1)>
'><script>alert(document.cookie)</script>

# Grep - Extract for Response Analysis
# Match patterns to identify successful attacks:
# - "Welcome" or "Dashboard"
# - "Invalid password" (failed attempt)
# - "Token" (authentication response)
# - Length > 5000 (potential data leakage)

Active Scan Configuration

# Custom Scan Definitions

# Insertion Points
- URL parameter values
- Body parameters (all types)
- Cookie values
- HTTP headers (with caution)
- HTTP method override parameters

# Exclusions
# Avoid testing these endpoints:
- Logout functionality
- Payment processing
- Password change without current pass
- Delete operations
- File upload endpoints

# Attack Strength
# Never: Disabled
- Light: Minimal payloads, few variations
- Low: Common payloads, some variations
- Normal: Balanced (recommended)
- High: Extensive payloads, may cause issues
- Insane: Maximum testing, testing tool limits

# Attack Pause
- Add delay between requests
- Useful for rate-limited applications
- Reduces chance of triggering WAFs

Extension Development Basics

# Setting Up Extension Development

# Requirements
- Jython (Python runtime for Burp)
- Or JRuby / BeanShell

# Download Jython
https://www.jython.org/downloads.html
Download installer.jar
Run: java -jar jython-installer-2.7.x.jar
Install to: /opt/jython

# Configure in Burp
# Extender -> Options -> Python Environment
# Set Jython executable path

# Simple Extension Example (Python)
from burp import IBurpExtender
from java.io import PrintWriter

class BurpExtender(IBurpExtender):
    def registerExtenderCallbacks(self, callbacks):
        self.callbacks = callbacks
        stdout = PrintWriter(callbacks.getStdout(), True)
        stdout.println("Extension loaded successfully!")
        callbacks.setExtensionName("My Custom Extension")