>> Using intercepting proxies in
web application security testing.
Our learning objectives are to explain why
intercepting proxies are important when performing
web application penetration testing and to
demonstrate how to configure and use OWASP ZAP,
Burp Suite, and Developer Tools.
This is where we get into
the technical part of this course and this is why
it's geared towards intermediate
cybersecurity professionals.
Because if I start talking about what a GET
request is or a POST request is or
the different methods that you can
use when communicating with a website,
you should already know what those are or you should be
researching that now as far as things like head,
or options, or delete, or put.
These are things that you should be familiar with.
This is why we use intercepting proxies because
it's a way for us to put ourselves
between the browser or client and the server and modify
that packet when it's sent to the server
so we can do things like
change a GET request to a PUT request,
or make it a DELETE request or a POST request.
That's why working with intercepting proxies
is so important when you're
a web application penetration tester.
The tool that I use basically every day is Burp Suite.
This is going to be a majority on Burp Suite.
I have one slide on ZAP.
I have one slide on Developer Tools,
although I use Developer Tools a lot.
I'll show you both Burp Suite and ZAP.
You can make up your mind which one you want to use,
which one's more familiar.
I'm more familiar with Burp Suite.
Luckily, I have the paid version,
the pro version of Burp Suite, which is excellent.
I am happy with Burp Suite and that's what I know.
That's not to say you can't do
the same things with ZAP and it's free.
Again, hands on experience is
what's going to tell you which one you prefer.
Burp Suite's made by PortSwigger in the UK.
They have a free academy that is
well worth your time if this is
a space you want to get into at
>> PortSwigger web security.
>> I use their labs a lot.
I love building my own labs,
but I think PortSwigger has excellent labs,
and they do a far better job than me with
web application security with
more of the advanced things.
If you're interested in things like HTTP request
smuggling or Web Cache
poisoning or very unique web attacks,
they have that on their platform.
The community edition is installed in Kali by default,
which is what we typically use as
pen testers, Kali Linux.
But the professional version is
well worth your money if you can afford it.
The license I think is $400 a year, which is a lot.
But if you want to get into
bug bounty work and things like that,
I think it's well worth the money spent.
>> That's 400 US dollars.
>> The contested point is that spidering
was in version 1.7 and it's since been removed.
Some people still have version 1.7 to use spidering,
whereas it's been removed
from the newer versions unless you
have the pro version where active scan is enabled.
Because Burp needs communicate with
these different websites and because websites
also use encryption with HTTPS for SSL or TLS,
you need to install a certificate in your browser.
If you have Burp Suite and you start going to
HTTPS sites and you see an error,
that's because you need to import
that Burp certificate into
your browser and make it trusted.
Here's the way to do that.
Is you go to in your browser,
you open up HTTP Burp Suite,
you install the certificate,
and I can show you this in the demo as well.
But that's how Burp Suite works with HTTPS sites.
That also is applicable for ZAP too because
that too is an intercepting proxy
and you need to configure ZAP with that applicator,
that piece of software's certificate authority as well.
How you get by that or how
you don't have to use it, I should say,
is this new embedded browser in Burp Suite 2.0.
You make an error when you're in Kali Linux.
To bypass that error,
I've given you the steps here.
You go to proxy, open browser, you see the error.
If that happens, you go to project options,
miscellaneous, and you check allow embedded browser.
Then if you go back to the proxy and open browser,
it should open for you.
You don't have to install
the certificate authority here
if you use the embedded browser here.
I like using the embedded browser.
Burp Suite proxy.
This is really the main component of Burp Suite.
When you open up Burp Suite and
intercept turns on by default,
you may be wondering why the
website isn't doing anything.
You may be entering information and posting data,
and it's just sitting there waiting
for you to turn intercept off,
or to forward that request,
or drop that request.
If you're sitting there wondering,
and this has happened to me and
many other people that I know,
wondering why nothing is happening in your browser,
it's because intercept is turned
on and you forgot to turn it off.
The thing with the proxy
or intercept is the fact
that you can then modify a packet.
That's the whole purpose of these intercepting proxies.
But we have some more functional tools
we can use as well.
You can send something like
this request to other things like repeater,
speaking of repeater,
here's Burp Suites repeater,
which I use often.
If you look very carefully at the screen here,
the request is a post request to this
>> login.php endpoint.
>> Again, this is why this is
an intermediate course is because you should
understand what all of this text
is for the request and response,
or at least be able to research it and understand it.
You can see here that it is a SQL injection, for MySQL,
to be exact,
with a sleep function of five,
and you can see I've highlighted it took five seconds.
The SQL injection took five seconds.
The great thing about repeater being the fact
that it tells me how long it took, so I know
here that my five second sleep command worked.
The ease of this is I can easily modify
the username parameter in here to
different things and easily see
what the response is without having to
enter it into the website and
looking at my watch for five seconds.
Intruder. Intruder is great because
you can use it to fuzz or
inject as you can see the payloads here.
That's basically I'm fuzzing this web application
with SQL injection payloads and seeing what I get.
You can grep for specific strings.
I grepped here for success.
You can see the ones that are checked means that I was
successfully able to authenticate
>> into that application.
>> You also need to specify the position for the attack,
which I'll show you in the demo.
Also, there are a bunch of attack types.
These are the primary ones.
I can tell you usually for logins,
I will use the sniper attack,
usually because I already know what the username
is and I'll use this for the password.
I'm trying a SQL injection and the username.
Or if I wanted to do a SQL injection for
the username and the password,
battering ram might be the right thing.
Because it places the same payload value
in all the positions.
If I put a position for
username and a position for password,
it will use that same value over again.
There's also pitchfork and cluster bomb,
which you can read here.
I don't use those as much as
I use sniper and battering ram.
I will say, hint,
battering ram may also be useful for
things like vulnerability like shell-shock,
where you can insert it into
things like the user agent string
or other headers to see if
you're able to command injection
into the vulnerable web application
is vulnerable to shell-shock.
Decoder. You may see something that's base64 encoded.
Here you see equal, equals, which is a tell,
tale sign of base64 encoding because it's
adding some padding in there with the equals.
You can see it says OWASP top 10.
We can decode that with the decoder,
decodes, and encodes, everything you see here.
Base64, URL, HTML, ASCII Hex,
Hex, octal,
binary, and Gzip.
Told you there's only one slide on ZAP.
You'll see ZAP in the demo.
I really want to show it to you rather
than speak to it a lot.
But what I like ZAP for is because they took that
scanning and spidering functionality
away in the free version of Burp,
I use it with ZAP.
I find it to be pretty useful.
That's why people I think prefer ZAP in that respect,
is that it has kept that attack,
they call it attack functionality to
tell you about there's a SQL injection here possibly,
or there's a cross-site scripting vulnerability here.
It will tell you all that.
Whereas in Burp,
unless you have the the pro version,
it doesn't have that automatic scanning capability.
It's also good to know the
>> basics of the Developer Tools.
>> As you can see here, I'm using
Firefox because in Firefox what I could
do is I can modify my requests,
where I can't do that in Chrome.
But just using Developer Tools in
Firefox as you can see here,
I'm messing around with the request body,
with the username,
and inserting a SQL injection.
If I can get my glasses on, it says,
"Or one equals one,
tell, tell SQL injection."
It's good to be able to use
your Developer Tools and know what they do.
Here we see all the network requests
>> that we can modify.
>> You can also look at your cookies in storage.
Also be familiar with Developer Tools as well.
In summary, I've explained why intercepting proxies are
important when performing
web application penetration testing.
Now what I will do is
demonstrate how to use both OWASP ZAP,
Burp Suite, and I guess I'll also show
you a bit about Developer Tools as well.