Welcome back.
We performed the set up of our Burset took, now let's see what we can do with it.
First thing that you will notice after the setup is that if you have burps it off, you will not be
able to visit any website at all.
Let me show you what I mean, for example, currently I don't have anything open, and if I go to my
Firefox.
And try to visit the page like Facebook dot com.
We get this after the proxy server is refusing connections, and this is due to our burset not being
started at this very moment.
Now, you can always remove Burset as proxy, if you'd like, by doing the same steps of going to proxy
settings right here.
Let me scroll all the way down to the network settings and under the proxy settings, all you want to
do is to remove the suit and make your Firefox run, as usual, is to select no proxy right here.
However, right now, we do want to have it as a proxy.
So let's just start our website by going to our terminal and typing it.
Let's wait for a couple of seconds for it to start up.
And while it's starting, let's also start our own SPW, a virtual machine.
Well, let's click on temporary project use defaults and start.
OK, so this is our window, we already saw it from the previous video and in this video, let's start
off by checking that intercept option that we saw in the last video.
So by default, once you open it intercept, which we can find under the proxy tab, will automatically
be on, as we can see right here.
And this will always be navigated under the proxy tab and under the intercept tab.
But what does this intercept option even mean?
Well, it's simple.
It will intercept every single HTP request that we try to send, and it will block it right here.
It won't forward it or drop it.
It will ask us what we want to do with it instead.
Let me show you how it looks like.
For example, once we have intercept off, if we turn it off, we can normally visit a page like Facebook
dot com.
As you can see, it will load everything.
Normally, there will be no problems.
It might work a little bit slower because we're going through it, but nonetheless, it will load the
page.
But if we try to reload the page with intercept being on, let's turn it on and let's click on this
reload button.
We intercept and HTP request, and this is the request that we're trying to send, here it is, we are
performing I get request on host Facebook dot com.
This request didn't reach its destination yet.
And we can confirm that by going to Firefox.
And as we can see, our page is not loading.
Instead, it seems as if it's still reloading, as we can see right here on our tap.
That is because it is waiting for us to choose what we want to do with this request, and we do have
some options right here, we can either forward the request or we can drop it and not send it at all.
But we also have this action button right here that gives us multiple options as to what we can do with
this request, such as send to sequencer sent to intruder's sent to repeater.
And these options are something that we will talk about in the next video.
But for now, let's see what happens once we forward this request.
Let's press forward.
Hmmm, another request comes in.
Why?
Well, usually when you visit a website, you don't just perform one single request, it is multiple
requests to multiple pages that once they are sent, we get to load this Facebook page.
In this case, our Facebook page does appear to be loaded.
As we can see right here, it's no longer loading, but we must also forward all of the incoming requests
as well.
So let's do that real fast.
Let's forward every single request that we get.
And that should be about --'s there were a lot of them, but now we can see no requests are being sent
anymore.
Now, you might have a couple of them coming every couple of seconds right here, as we can see here,
one that came a couple of seconds late, and this will depend on which page you're trying to load.
So a couple of requests might come every couple of seconds.
As we can see, even though we forwarded this one, another one might come in just a couple of seconds.
And here it is.
Now, another thing that we can do, for example, is to modify our request, let's turn our intercept
off for a second.
Let's go to our Firefox and let's first check what is the IP address of our always machine.
It is one attitude, 168 at one point five in my case.
Let me visit it.
And let's, for example, go right here.
To the TV W8.
And if we turn our intercept on and for example, we try to submit test username and password.
We intercept the request right here, we can see we are trying to perform a post request on this page
because we are actually sending some data inside of a form which in this case is username and password.
And here we can see test and test to be the username and password.
Now, if we want, we can change this data.
We can, for example, type test one, two, three, and we can forward our packet.
Let's forward this one as well.
And this one.
And if I go right here, it will tell us login failed.
So that is incorrect password and also incorrect username.
Now let me turn intercept off and just so I can show you the changing of certain things in an HTP request
works.
Let me tell you that the username and password for this BBWAA page is admin and admin.
So once you type admin and admin, click on login, you will successfully log into this page.
But let's try to turn on intercept, right?
Incorrect username and password, which is once again test and test.
And let's try to modify it right here to the correct username and correct password just so we can see
whether we manage to login.
So admin, admin, we forward the request and lets forward other requests as well.
And now you can see that we managed to log in to this page.
Awesome.
This is the power of intercepting the requests.
Now, did we explore this option in the next video, we're going to take a look at some other possibilities
with Burset.
See you there.