>> All right. Now time for our hands-on demo.
As you can see, I'm in Kali Linux,
which is the distribution that I like for pen testing,
for web application pen testing.
There are other ones out there.
There's Parrot OS and some other things.
You can even use something like Ubuntu if you
wanted but typically Linux is
what us pen testers and hackers like to use.
You'll notice I'm at the Firefox browser,
and like I talked about,
there's some functionality that you can use
>> in developer tools when you're just
>> in the Firefox browser.
>> I see that we have an author
named user for this WordPress site.
I know a little bit about WordPress sites,
so I'm going to go to the login now and try to
brute force the user's password.
So I can do user
and I can type anything as a password.
But before I hit Log in,
I'm going to hit F12 or
I can right-click and do inspect element.
But that will bring up these developer tools for me.
I'm already in the Network tab.
I'm already in the Network tab
and what I'm going to do from
here is I'm going to bring this down.
You can also configure this to
different size, the right, to the left,
I like it at the bottom,
but I do log in,
I'm not going to save that.
I'm going to go to the top,
and I notice that it tells me it's a post request,
is posting data,
and if I want to,
I can go to re-send and edit and resend,
then I can change my password as you see here,
it was just a string of numbers.
I can do something like password and send that.
You'll see that's the bottom request here.
If I double-click, it will send that.
As you can see, that didn't work.
Okay. Let's help ourselves out and use Burp Suite.
I'm going to tell you is I like to use an extension.
I use SwitchyOmega,
which is an add-on that you can use here,
and extensions with Firefox.
What I can do with this, as you see,
I have it configured already to
toggle between Burp Suite and ZAP.
If we look at options a little bit closer,
we can see that ZAP,
I have it set to http localhost 8081 as the port,
and for Burp Suite is http 127001 is
also localhost and port 8080.
I like using the embedded browsers in both tools.
I typically don't proxy it through Firefox anymore,
but I wanted to show you that.
What we're going to do here is we're going
to proxy this through Burp.
I'm going to do the dragging here.
I'm going to type Burp,
and you see I have the Pro Edition,
the Community Edition, and an older edition here.
I'm going to use the Community Edition
with the embedded browser.
We'll click Next and we'll start Burp Suite.
If this was not set to intercept,
it Firefox would not be
communicating through Burp Suite with the server.
That's why I need to have it set to Burp Suite.
If I refresh this page,
you'll notice proxy lights up in orange.
Now, first of all,
I see that there's a advertisement
for the pro version here.
I'm going to exit out of that.
I'm going to go to proxy
and I see that nothing's going to happen.
Nothing's going to happen until I do
Intercept off, until I click this.
But I can right-click this and do the send repeater,
send to sequencer, or send to intruder.
I can send that to repeater.
Then what I can do is I can send this request.
I can change this to anything
literally and hit Send and see what happens.
I can also right-click and send this to intruder.
Now you'll notice this is still going back and forth.
It won't stop until I unclick Intercept off.
Let's look at intruder,
but it automatically picks positions for us here.
We can clear this and what we're worried about here is
the password, password parameter.
We want to do a brute force attack.
I'm already in sniper for my one payload.
I'm going to load Adobe
top 100 passwords and I'm going to start the attack.
You'll notice it already gives me a warning
>> that this is the Community Edition
>> and it's going to go slow.
>> We'll just let that run and see what happens.
As you can tell, this takes a long time.
But if I look at the requests,
I'll see that the password
is changed in every one of these.
Since this is a live server,
my server, I'm just going to exit out of here.
Now I also talked to you about the fact
that for https sites,
you need to configure Burp Suite to speak
with that by downloading the certificate for it.
To do that, you're going to go to http burp.
You're going to download the CA certificate,
save the file.
You're going to preferences.
You'll type in certificate view, certificate import.
I've already imported it before,
so it will give me the certificates already installed.
But you're going to install that certificate and that
way you can go to https sites using Burp Suite.
But again, I like using
the embedded browser. How do you use that?
Now if you just have a version
of Kali and you just do open browser,
is going to say there's an error.
Like I told you before,
go to Project Options,
Miscellaneous, and you're going to go down here to
allow the embedded browser to run without a Sandbox.
Go back to proxy and click Open.
Now we have our embedded browser,
so I don't have to worry about certificates
or going to https sites.
It will all do that by default.
I could go to Google.
If I go to Target here,
you'll see Google is in here already.
That's the benefit of using the embedded browser.
Something else I wanted to talk
about briefly is extender.
Extender has this great store here where it has
all these different extensions that you can download
and make it almost as good as the paid version.
Some ones that I really like are Param Miner up here,
which can look for things
like DOS based web cache poisoning,
as well as Logger++.
When you're running something like Param Miner,
it will show you all the
different requests that you've made.
Here's a Logger++.
All you have to do is click Install,
and it will install it, and then you can use it.
Unfortunately it failed for me.
Hopefully it will not fail for
you and you'll be able to install it.
But go ahead and check out the store,
the extensions for Burp Suite.
Now I'm going to go to ZAP.
I just have to type ZAP in here.
ZAP is free. There's no paid version of ZAP.
It's made by OWASP.
I'll click, No, I do not want to
persist this session at the moment in time.
The cool thing about ZAP is you can
do an automated scan and it's incredibly noisy.
You want to make sure you have
permission to be attacking a server.
Another thing is know it's going to create
a lot of noise and it's going to
be pretty invasive as far as the request it makes.
Because I don't want to be too loud on my server here,
my EC2 instance,
I'm going to take this.
I'm going to go to Manual
and I am going to launch Firefox.
Either Firefox or Chrome,
this is the built-in browser for ZAP,
so I don't have to proxy it through anything.
Now you can see it has this cool bar here,
but also this heads up display.
I took the tutorial in
preparation for this course. I liked it.
I highly recommend that you do it.
I'm going to continue to my target.
You already saw some alerts pop off here.
So unlike the Community Edition of Burp Suite,
ZAP will give you some warnings,
some informational warnings, medium, low.
You can click this and see what it's found.
That's pretty cool. Like Intercept,
Burp has this thing called break.
If I went here and hit Break in you click,
Hello world, as you can see,
it captures the request here.
I can change this to a different method
and step through and it will show me the response.
Fortunately, that didn't do anything
cool but that's what you get.
You can step through it again
and you can see that I'm on this page here.
So break is like intercept.
You can also see your history down here.
If you click that,
>> it will show you what your history is.
>> You can see of course history in here as well,
as well as any alerts there might be.
We have some X-Frame option header is not set.
Alerts, we have two.
If we click this here,
it will tell us which endpoints it found that on.
If we double-click, it
will give us a little bit more info.
You can edit the alert if you want to.
As you can tell, all these tools
have a lot of functionality.
I could spend days going through Burp Suite and ZAP,
but that's what this course is for,
is to give you the hands-on practice with
the OWASP Top 10 using these different tools.
While we go through this course, try ZAP,
try Burp Suite, try Developer Tools.
See which one you like, see which one you don't.
As you can see, ZAP has some tools that
Burp doesn't in the free edition,
like the active attack as well as spidering.
If I go here,
I can spider this host.
Well, let's go to heads up display.
We can click Start here and it will spider this host.
It will find all the links that it
can and it will tell you that,
that's not in Burp Suite in the Community Edition.
Again, I could go on and on about
these two different tools as well as developer tools.
But again, find which one you like.
That's just briefly how to use Developer Tools,
Burp Suite and OWASP
ZAP in the course and the content that is to come.