Burp Suite Web App

Module 4 – Web Application Testing with Burp Suite: From Proxy to Pwn

"If Recon tells you where the doors are, Burp Suite tells you which ones are unlocked."

Welcome to the module that separates script-kiddies from web application hackers. Burp Suite isn't just a tool—it's an ecosystem. By the end of this guide, you won't just know what the buttons do; you'll have a repeatable workflow to systematically tear apart web applications and document your findings like a pro.

What Makes Burp Suite the King?

Unlike command-line scanners that spray and pray, Burp Suite sits between you and the target. It sees every request, every response, every cookie, and every hidden parameter. It is the center of gravity for modern web app testing.

Phase 1: The Setup — Proxy & CA Certificate

Before you can hunt, you need to see the traffic. Burp's Proxy intercepts everything your browser sends.

Step-by-Step Configuration

1. Launch Burp & Start the Proxy

• Open Burp Suite → Proxy → Options
• Confirm proxy listener: 127.0.0.1:8080

2. Configure Your Browser

• Firefox: Settings → Network Settings → Manual proxy configuration
  • HTTP Proxy: 127.0.0.1
  • Port: 8080
  • Check "Use this proxy server for all protocols"

3. Install the Burp CA Certificate This stops SSL/TLS errors when intercepting HTTPS traffic.

bashCopy
1# Download the CA cert via Burp's built-in interface
2http://burpsuite/cert

• Firefox: Settings → Privacy & Security → View Certificates → Authorities → Import → Select cacert.der → Trust to identify websites
• Chrome: Settings → Security → Manage Certificates → Import under "Trusted Root Certification Authorities"

✅ Pro Tip: Use FoxyProxy Standard browser extension. Create a profile for 127.0.0.1:8080 and toggle proxy mode with one click.

Phase 2: Build Your Battlefield — Site Map & Recon

Browse the target application naturally. Click links, submit forms, log in, log out. Burp's Target → Site map builds a tree of every endpoint, parameter, and cookie it observes.

What to Look For in the Site Map

• Interesting parameters: id=, file=, redirect=, token=
• Hidden endpoints: /api/, /admin/, /backup/, /dev/
• Technology fingerprints: Response headers revealing frameworks (ASP.NET, PHP, Express)
• Input vectors: Every field that accepts user data is a potential injection point

Supporting Tool: Gobuster (Directory Discovery)

While Burp maps what you click, Gobuster finds what you don't.

bashCopy
1# Classic directory brute-force
2gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt
3
4# Advanced scan with extensions and status code filtering
5gobuster dir -u https://target.com \
6  -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
7  -x php,txt,html,zip,bak,old \
8  -t 50 \
9  -o gobuster_results.txt

Supporting Tool: FFUF (Fast Fuzzing)

FFUF is lightning-fast and perfect for virtual host discovery and parameter fuzzing.

bashCopy
1# Directory fuzzing
2ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt
3
4# Virtual host discovery
5ffuf -u https://target.com -H "Host: FUZZ.target.com" -w subdomains.txt
6
7# Parameter fuzzing (GET)
8ffuf -u "https://target.com/page?FUZZ=1" -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt
9
10# Parameter fuzzing (POST)
11ffuf -u https://target.com/login -X POST -d "FUZZ=test" -w params.txt

🎯 Burp Integration: Save FFUF or Gobuster output, then manually browse discovered endpoints through Burp Proxy to populate your Site map with fresh targets.

Phase 3: Interception — The Art of the Proxy

Proxy → Intercept is where the magic happens. Turn "Intercept is on" and watch requests freeze in time.

What to Do With Intercept

1. Modify on the fly: Change a User-Agent, flip a role=user to role=admin, or tamper with JWT tokens before they reach the server.
2. Drop malicious requests: Test for SQL injection by changing id=1 to id=1' OR '1'='1 right in the proxy.
3. Replay with tweaks: Right-click any request → Send to Repeater.

Practical Example: Bypassing Client-Side Validation

You submit a form with a "price" field locked to $100 via JavaScript. With intercept on, you change the POST body to price=1 before it leaves your machine. If the server accepts it, you've found a business logic flaw.

Phase 4: Repeater — Surgical Precision

Repeater is your manual testing workbench. It lets you modify and resend the same request hundreds of times without re-creating it.

Repeater Workflow

1. Right-click an interesting request in Proxy history → Send to Repeater
2. In Repeater, modify headers, parameters, or body content
3. Click Send and analyze the response in real-time

Real-World Use Cases

💡 Pro Tip: Use the Comparer tab to diff two responses. Did changing the role parameter alter the response size? You might have found privilege escalation.

Phase 5: Intruder — Automated Fuzzing & Brute-Forcing

When manual testing in Repeater becomes repetitive, Intruder automates the pain.

Attack Types You Should Know

Practical Example: Fuzzing for Hidden Parameters

You suspect https://target.com/profile?user=admin has hidden parameters. Use Sniper:

1. Send the request to Intruder
2. Clear default positions, highlight user=admin value only, or add a new parameter: ?FUZZ=test
3. Load a wordlist like burp-parameter-names.txt
4. Set payload position markers around FUZZ
5. Attack! Look for anomalies in response length or status codes.

Practical Example: Credential Stuffing

bashCopy
1# Pitchfork attack setup:
2# Position 1: username parameter
3# Position 2: password parameter
4# Payload 1: usernames.txt
5# Payload 2: passwords.txt

Look for status code changes (302 Redirect = potential success) or unique response content.

Phase 6: Supercharge Burp — Essential Extensions

Burp's power multiplies with extensions. Install them via Extender → BApp Store.

The Must-Have Toolkit

Turbo Intruder Script Example

When you need raw speed, Turbo Intruder outperforms standard Intruder:

pythonCopy
1# Turbo Intruder script: Hidden parameter brute-force
2def queueRequests(target, wordlists):
3    engine = RequestEngine(endpoint=target.endpoint,
4                           concurrentConnections=30,
5                           requestsPerConnection=100,
6                           pipeline=True
7                           )
8    
9    for word in open('/usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt').read().splitlines():
10        engine.queue(target.req, word)
11
12def handleResponse(req, interesting):
13    # Flag responses that don't return 404
14    if req.status != 404:
15        table.add(req)

Phase 7: Confirmation with SQLMap

Burp helps you find the injection point; SQLMap helps you own it.

The Workflow

1. In Burp Proxy, find a request with a parameter that behaves strangely (id=1' causes an error)
2. Right-click → Copy to file or Copy as curl command
3. Feed it to SQLMap

bashCopy
1# Basic scan — detect the DBMS
2sqlmap -u "https://target.com/page?id=1" --batch
3
4# Dump database names
5sqlmap -u "https://target.com/page?id=1" --batch --dbs
6
7# Dump tables from a specific database
8sqlmap -u "https://target.com/page?id=1" --batch -D target_db --tables
9
10# Dump entire database (use with permission!)
11sqlmap -u "https://target.com/page?id=1" --batch -D target_db --dump
12
13# Using a Burp request file
14sqlmap -r request.txt --batch --dbs

⚠️ Ethical Boundary: Only use --dump on systems you own or have explicit written permission to test.

The Complete Workflow: From Zero to Findings

Here is the repeatable script you should run on every web app engagement:

bashCopy
1#!/bin/bash
2# webapp_assessment.sh - Full Burp-Suite-Driven Web App Test
3
4TARGET="https://target.com"
5WORDLIST="/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt"
6
7echo "[*] Phase 1: Directory Discovery with Gobuster"
8gobuster dir -u $TARGET -w $WORDLIST -x php,txt,bak,zip -o dirs.txt
9
10echo "[*] Phase 2: Parameter Fuzzing with FFUF"
11ffuf -u "$TARGET/page?FUZZ=1" -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt -o params.json
12
13echo "[*] Phase 3: Virtual Host Scanning"
14ffuf -u $TARGET -H "Host: FUZZ.target.com" -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt
15
16echo "[*] Phase 4: Browse target through Burp Proxy"
17echo "    - Set FoxyProxy to 127.0.0.1:8080"
18echo "    - Navigate through all app functionality"
19echo "    - Review Target > Site map for hidden endpoints"
20
21echo "[*] Phase 5: Manual Testing in Repeater"
22echo "    - Test for IDOR by modifying IDs"
23echo "    - Test for SQLi with manual payloads"
24echo "    - Test auth bypass by removing/altering tokens"
25
26echo "[*] Phase 6: Automated Fuzzing with Intruder"
27echo "    - Sniper attack on suspicious parameters"
28echo "    - Cluster bomb on login forms"
29
30echo "[*] Phase 7: Authorization Testing with Autorize"
31echo "    - Configure low-privilege session cookie"
32echo "    - Browse app and watch for 200 OK on admin endpoints"
33
34echo "[*] Phase 8: Confirm vulnerabilities with SQLMap"
35echo "    sqlmap -u '$TARGET/vuln.php?id=1' --batch --dbs"
36
37echo "[+] Assessment complete. Review Burp's Target > Site map and Issue activity."

Key Takeaways

1. Burp Suite is your C2 for web apps. Everything flows through it.
2. Always install the CA certificate first. No cert = no HTTPS visibility = missed findings.
3. Site map is intelligence. The more you browse, the more attack surface you expose.
4. Proxy + Repeater = Manual mastery. This is where critical bugs like business logic flaws live.
5. Intruder scales your effort. Use Sniper for precision, Cluster Bomb for brute-force coverage.
6. Extensions are force multipliers. Autorize alone can find authorization bugs you'd miss in hours of manual testing.
7. SQLMap confirms; Burp finds. Use them as a one-two punch.
8. Document in real-time. Logger++ and Burp's built-in notes save you from "What was that endpoint again?"