OK, this section is important, even though it will be a short one, you will find using Burset a lot.
But before we get to setting it up, let's first briefly discuss what it is.
Perhaps it is a platform specifically designed for testing of Web applications.
It has many tools that make testing process much easier, and it's also used as a proxy.
Not a proxy in the sense that it will hide your IP address, but proxy in the sense that it will allow
us to inspect all the packets and HTTP requests and responses that we do while visiting a certain page,
it will allow us to intercept different requests, modify them and then forward them to the Web page
or to drop them if we choose to.
Burset is considered number one tool for bug bounty for many penetration testers.
In this section, we're going to set it up and check out some basic options that it has and the rest
of it, we will practice throughout the course.
Let's first start off by configuring it as a proxy for our Firefox, so to do that, the first thing
that we want to do is we want to open terminal and start our Pepcid, and we can do that by typing it
inside of our terminal press enter.
And in just a few seconds, we will get the opening menu for this.
And unlike many other tools that we use before, this tool has a graphic user interface, so it will
be much easier to use and to navigate through.
If you get this community addition warning, you can click here on OK, and in a few seconds we will
get to open Burset.
OK, here is the opening window, you can leave this checked or unchecked, whatever you like and click
on, I accept.
Once this window opens up and you might also get this window opened up, which says an update is available,
you can update it now, but if you get it, just click on Close for now.
And here, select a temporary project, click on next and use burb defaults and click on Start Berp.
This will open our project in just a few seconds and then we will be fully able to use it.
Now, one more thing to mention is that it has a community edition and professional edition.
A community edition is free while professional edition is paid.
And it does allow us some other additional options that we can use with this tool.
However, for this course, we will be using the free community edition.
Once it opens up, you will get a window that looks something like this.
Let me enlarge it, and I know that there are many things happening right now, but don't worry, all
of this is simple.
First thing that we want to do in order to configure it with our Firefox as a proxy.
We want to navigate right here on proxy.
Make sure that this intercept is off by clicking on it, it will simply just say intercept is now off.
Then navigate to the options and make sure that you have in this small window one twenty seven zero
zero, that one on Port 80 80 and make sure that you also have it checked.
If you don't have this option right here, just click on ADD and you can add it right here.
Since I already have it, I'm not going to add anything.
I'm just going to leave it as it is.
And the next step that I want to do is start our Firefox.
Once you start over Firefox, we want to navigate to Firefox settings.
You can do that by going on these three lines.
Scroll a little bit down onto the preferences, click on that.
And under the general settings, we want to scroll all the way down until we get to network settings
right here in the network settings, click on the settings button.
And it'll open the first setting, which is a proxy configuration, which should, by default be set
to no proxy.
We want to change it right now to Manuell proxy configuration and in the manual proxy configuration
under the HTP proxy tab, we want to select one twenty seven zero zero, that one as an IP address on
board 880, the same settings that we have inside of our Burset under the options tab.
Once you set it right here, check this option as well, that says also use this proxy for FTP and https
and it will autofill these two fields with the same settings.
Once you have it looking like this, click on OK.
And if you try to visit any HTP page right now, for example, I will go to this page.
Just make sure that it is an HTTP page and not an https.
And if it is an HTP, it will successfully load the page and you will notice that it also does do it
a little bit slower because right now all of our connection is going through our burset, through our
proxies.
We can see here is the link right here.
But if you tried to, for example, visit any HTP page, let's go to Facebook dot com, for example.
It will give you this error did not connect potential security issue.
Now, in order to fix this, we must download the birth certificate and add it to our Firefox certificates.
How can we did it?
Open another tab, navigate to HTP to birth, visit that link and it will open a window like this.
On this window, we have this button right here that says see a certificate.
Click on that.
And save file, click on OK, and it will download this file for us, which will be in our download
directory.
After we do that, we want to go back to our Firefox's settings and we want to navigate to privacy and
security tab, once again, we want to scroll all the way down until we get to the option that says
certificate's right here.
Then click on View certificates, and here we want to import the file that we just downloaded, how
can we do that?
Well, simply just click on import, navigate to the downloads directory and select the file that we
just downloaded and click on it.
Once it opens this window, check both of these options that says trust this certificate to identify
websites and trust this certificate to identify emailed users, check both of them and click on OK,
then you can click on OK right here as well.
And now we should be able to fully use our Firefox and we have completed the purpose it set up.
Let's double check again on Facebook whether we can visit https page.
And right now, it loads it without any error, and we can also see if we go to the target, Tabin,
our Burset, we can see that we successfully loaded https, Facebook dot com, and that's pretty much
it.
If you can load both HTP and https pages after configuring Burset, then you are good to go.
In the next couple of videos, we're going to check out some stuff that Burset allows us to do.