Hi and welcome back to Section 8
web application attack.
In this video, you will learn how to set up foxy proxy
and get started using boob Suite. I hope
you're excited. So let's save onen.
To get started, please and show you Paul on your
Carly Linux virtual machine.
In this video, we'll be looking at two specific tools.
One of which is called boobs. Sweet buff sweet
is simply very popular web application
security vulnerable tea and exploitation tool
that is commonly used by cybersecurity professionals
such as ethical hackers pantry shantesses
and even red teamers to discover
security weaknesses found within web applications.
The way that boobs sweet weeks is simply by intercepting the
web traffic between your web browser
and the target web application.
Typically if we were to open our web browser like
so
All web browser send an HTTP
requests directly to the
web application, which is Google's website. Then
Google website will simply respond to us.
What boobs suit will do is simply proxy the
traffic and allow us to intercept the traffic
and even make changes then we can simply replay
these chain traffic or the modify
traffic to the actual web application. But before we
get started with boob Suite there's one important tool that
we need to install this tool is called foxy proxy
this tool simply allows us to configure
multiple proxy profiles within our web
browser to Simply allow us to easily change your
proxy settings without having to do it manually each
time.
To get started to install foxy proxy. Let's
head over to Google within our Firefox web
browser that is running inside of Kali
lyrics
simply search for
addons Mozilla
like so
simply click on a Swiss website that says add-ons for
Firefox.
next
on the top right hand corner, simply use this
search field and search for foxy proxy
like so
here you will see that there is an option which is called foxy proxy
standard simply click on it.
Next simply click on add to Firefox.
This will take a few minutes and it
will ask you to approve the installation.
simply click on ADD
after a few minutes or a few seconds foxy proxies
know added as an extension within
your Mozilla Firefox web browser. Let's click
on okay.
We can close the stop.
And to get started setting up
foxy proxy.
we can simply click on the foxy proxy icon
like so
Now, let's click on options.
Apparently we have no options configured.
to add the boob Suite proxy configurations simply click
on ADD like so
and here we can set a title. Let's set
a very easy to understandable title. We'll call
this Boop Suite.
Proxy like so great.
We'll ensure the proxy type it is http.
The proxy IP address we will use the lubak address,
which is 127.0.0.
dot one like so
both Suite uses port 8080. So now
let's set port 8080 like so
and great.
When you're ready simply click on Save.
excellent
We can close the stop.
And whenever we want to enable our proxy four
boob Suite we can simply click on a foxy
proxy icon like so and simply choose poop
sweet proxy.
And you can see now the boobsit proxy settings
as enabled.
Since boob suit is not running will not be able
to browse any website. So let's turn it off momentarily like
so
great.
Let's get started with boob Suite simply minimize
your Firefox or a browser.
Let's click on a Carly icon on the top left hand
corner like so
let's click on.
Web applications analysis and let's
click on Boosie.
we can simply accept the terms on condition like so
on this screen simply click on x
And let's click on start boob Suite.
Let's click on OK.
Great.
Let's settle back to our web browser and enable to
boob Suite proxy.
Let's minimize.
excellent
on boob Suite let's click on proxy.
I'm currently we can see The Intercept is standoff.
This means to see that burp Suite will not be intercepting any
traffic that is sent between our web browser
and any Target web application.
We will turn on in this app in just a few moments.
on this same proxy tab simply click on options like
so
and let's scroll down to the section that says intercept client
requests.
Which is right about here.
simply check the unbox like so
let's screw along just a little bit wait says intercept silver
responses.
Let's also check the unbox.
Great.
next let's head over back to
intercept
let's turn on in this app simply by clicking this button.
So at this point, we'll see it will simply intercept any
web traffic between a web browser and
a Target web application.
create
let's click on dashboard.
If you recall we had installed a vulnerable web
application on Kali Linux, which is
known as Shoe Shop. Let's turn on
Juice Shop and try to intercepts on traffic.
To do this. Let's open our terminal like
so
let's type sudo docker.
run
dash dash arm - P will
specify the ports and now
we'll specify the Juice Shop.
Simply hit enter.
Let's enter our Carly learnox password.
And this will take a few seconds for the application to
run.
Great currently we can see.
The Juice Shop application is running on
Port 3000.
Let's minimize this.
Let's head over to our web browser.
And now let's head over to http colon slash
slash.
127.0.0.1
and let's specify the port.
by typing cool on
3000 like so
great.
Simply hit enter.
And here we can see the application has looted.
However, notice that on boob Suite
the proxy tab is highlighted.
Currently we can see that there's a probe.
Let's click forward if you times.
Great. Let's click back on target.
And if you notice that burp Suite is
actually intercepting traffic for various destinations.
Let's simply click on a URL.
That has been used for juice shop, which
is this one.
Right click on it and select add to scope.
Simply select. Yes.
Next let's click.
on this area within boob Suite
Now let us select show only
in school items.
And click apply.
This will allow us to only view what is within
scope. This option is really important for
us simply because we don't want to be intercepted any
other communication beyond. What
is our Target?
if we expand
we can see exactly what boob Suite
has discovered so far.
We can see the assets.
We can see any GS Pages. We can
even see any folders.
And we could even see the web requests on the
web responses.
Let's click back on proxy.
And notice now that we have a post message.
Remember every response or requests. It
has been intercepted by boob Suite.
And therefore sometime when we make a request with
our web browser. It will be intercepted by boob
suite are the connection will not be complete.
Let's click on forward if usimes.
Notice now that we are requesting this resource.
If you click forward again, you can see there's a
post. Let's click forward a few
times.
Great.
So now the contents of the web application is looted properly.
I'm simply going to click on this like so
and great.
There are no more new requests that is appearing on
Loop Suite.
Within the Juice Shop web application. There's actually
a scoreboard to complete various challenges.
This scoreboard can be easily found.
By modifying the URL like so simply type
score dashboard like
so and hit enter.
Notice the web application has stopped.
Let's check boob Suite once more.
Let's click on forward.
Just a few times.
Great.
So we have completed one of the very first challenge which
is finding the scoreboard.
Within a scoreboard we can see various challenges
their categories on a description.
You can use a scoreboard to learn more about web application
security vulnerabilities and even
uses as a learning experience. However, during
the course of the section will take
a look at exploiting various databases
on completing some of these challenges to
learn more about the insecurities that exist within
web applications.
During the course of this video you have learned how to install and setup
foxy proxy on the Mozilla Firefox
web browser.
Additionally, you have learned how to configure boob suite
and understand the purpose of intercepting the data
between the web browser on the web application as
an aspiring penetration tester on ethical
hacker in the next video. You will learn how to
perform SQL injection attacks on a vulnerable
web application. I hope this video has been a
formative for you and I will see you in the next one.