Hands-on: Menggunakan Burp Suite untuk Menganalisis dan Mengeksploitasi Web App (en)

From OnnoWiki
Jump to navigation Jump to search

Burp Suite: A Versatile Tool for Penetration Testers

Burp Suite is a popular tool among penetration testers, offering a variety of features to comprehensively test the security of web applications, from identifying vulnerabilities to exploitation. This powerful tool allows users to audit and exploit web applications with ease. In ethical hacking classes, Burp Suite helps understand how to analyze the security of web applications through various attacks.

Hands-on on Kali Linux 2024.3

Kali Linux 2024.3 is a Linux distribution specifically designed for penetration testing and information security. This distribution comes with various tools, including Burp Suite.

Basic Steps

  1. Installation (if not): If Burp Suite is not installed, you can install it via the terminal with the appropriate command.
  2. Start Burp Suite: Once installed, run Burp Suite from the application menu or terminal.
  3. Proxy: Configure your browser to use Burp Suite as a proxy. This allows Burp Suite to capture and modify all HTTP/HTTPS traffic passing through your browser.
  4. Target: Specify the target web application you want to test. You can enter the URL of the application into Burp Suite.
  5. Start Analysis:
    • Spider: Use the spider feature to map the structure of the web application.
    • Repeater: Manually test each HTTP request to find vulnerabilities.
    • Intruder: Perform automated attacks on input parameters to find vulnerabilities such as SQL injection, XSS, etc.
    • Scanner: Run a scanner to perform automated testing for various types of vulnerabilities.

Practical Example: Finding SQL Injection

Let's say we want to test a simple login form. We can do the following steps:

  1. Identify Parameters: By using the repeater feature, we send a login request with different username and password values. Pay attention to the changing part of the URL, this is usually a parameter that we can manipulate.
  2. Payload Injection: Change the password parameter value by adding special characters such as apostrophes ('). If the application is vulnerable to SQL injection, a different error message or inappropriate behavior will appear.
  3. Confirmation: Test with various other SQL injection payloads to ensure vulnerability.

The Importance of Understanding Concepts

In addition to practicing, it is important to understand basic concepts such as:

  • HTTP: The protocol used for communication between a web browser and a server.
  • SQL Injection: An attack that exploits vulnerabilities in SQL queries.
  • XSS (Cross-Site Scripting): An attack that injects malicious scripts into a web page.
  • CSRF (Cross-Site Request Forgery): An attack that forces an authenticated user to perform an unwanted action.

More Details on Burp Suite in Kali 2024.3

Starting Burp Suite in Kali 2024.3

  • Open a terminal in Kali 2024.3 and run Burp Suite by typing:
burpsuite
  • Burp Suite will open with several options. Select the "Temporary Project" option and then click "Start Burp."

Browser Configuration

  • Burp Suite acts as a proxy that intercepts all web traffic between the browser and the web server.
  • Open a browser (e.g. Firefox) and set the proxy to use Burp Suite:
    • Navigate to `Preferences` > `Network Settings` > `Manual Proxy Configuration`.
    • Set the HTTP Proxy to `127.0.0.1` and port to `8080`.
    • Check “Use this proxy for all protocols” and save.

Starting Web Application Reconnaissance

  • Access the target web application through a browser configured to bypass the Burp Suite proxy.
  • In the Proxy tab of Burp Suite, you will see all requests and responses that pass through the proxy.
  • Enable the "Intercept" option to see HTTP requests sent from the browser.

Analyzing HTTP Requests and Responses

  • Every time a user accesses a web page, Burp Suite will intercept the HTTP request. You can examine details such as the URL, headers, cookies, and body of the request.
  • Example:
GET /login.php HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Accept: text/html
Cookie: sessionid=abc123
  • Burp Suite also displays the response received from the server, which can contain status codes, HTML, and scripts.

Using Intruder for Brute Force Attacks

  • Intruder in Burp Suite is used to perform attacks such as brute force, where we try various combinations of usernames and passwords.
  • For example, we have a login form like this:
<form action="login.php" method="POST">
    <input type="text" name="username">
    <input type="password" name="password">
    <input type="submit" value="Login">
</form>
  • Steps:
  1. On the login request has been captured by Burp, right-click and select "Send to Intruder."
  2. In the Intruder tab, set the target and attack position to username and password.
  3. Enter a list of usernames and passwords (wordlist) that you want to try.
  4. Click "Start Attack" to try various combinations of usernames and passwords.
  • The attack results will show different responses when the username and password are correct.

Analyzing Vulnerabilities with Burp Suite Scanner

  • Burp Suite has an automatic scanner that can be used to detect common vulnerabilities such as SQL Injection, Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF).
  • Right-click on the request in the Proxy tab and select "Scan" to start the automatic analysis.

XSS (Cross-Site Scripting) Exploits

  • Once the HTTP request is analyzed, you can try to inject an XSS payload into the input parameters.
  • Suppose there is a comment form in a vulnerable web application:
<form action="comment.php" method="POST">
    <input type="text" name="comment">
    <input type="submit" value="Post">
</form>
  • Send an XSS payload, such as:
<script>alert('XSS!');</script>
  • If the application does not properly validate input, this JavaScript will be executed in the browser, indicating that the application is vulnerable to XSS.

SQL Injection Exploits

  • SQL Injection occurs when user input is directly inserted into a SQL query without proper validation.
  • In a vulnerable login form:
SELECT * FROM users WHERE username = '$username' AND password = '$password'
  • Enter the injection payload in the form:
' OR '1'='1
  • If the application is vulnerable, this will bypass authentication because the SQL query becomes:
SELECT * FROM users WHERE username =  OR '1'='1' AND password =

Performing a Repeater Attack to Test the Same Attack Repeatedly

  • Repeater allows testing of HTTP requests repeatedly with manual changes.
  • Send a suspect request through the Repeater and change parameter values ​​or headers to see how the server responds in various scenarios.

Closing and Analysis Results

  • Once the attack and analysis are complete, be sure to disable the proxy in your browser and quit Burp Suite.
  • Document the results of the analysis, including potential vulnerabilities found and suggestions for remediation.

Example Case Study:

A web application has a login page that is vulnerable to brute force. Using Burp Suite, students can:

  1. Analyze login requests.
  2. Use Intruder to try different combinations of usernames and passwords from a wordlist.
  3. Discover that the application does not limit the number of login attempts, leading to a successful brute force attack.

With this exercise, students will understand how attacks such as brute force, SQL injection, and XSS work, and how to analyze and mitigate these risks in web applications.

Additional Tips

  • Study the Burp Suite Documentation: The Burp Suite documentation is very comprehensive and provides many usage examples.
  • Follow Tutorials: There are many online tutorials that you can follow to learn more about Burp Suite and penetration testing.
  • Join the Community: Joining the ethical hacking community can help you gain new knowledge and experience.

Conclusion

Burp Suite is a very powerful tool for testing the security of web applications. By understanding how to use Burp Suite and the basic concepts of penetration testing, you will be able to find and exploit various types of vulnerabilities in web applications.

Disclaimer: Penetration testing should be performed with the permission of the system owner. Using this tool for illegal purposes is irresponsible.

Interesting Links

  • Ethical Hacking
  • "How to fuzz with Burp Suite?"
  • "What is the difference between active scanning and passive scanning?"
  • "How to exploit XSS vulnerabilities?"
Retrieved from "https://onnocenter.or.id/wiki/index.php?title=Hands-on:_Menggunakan_Burp_Suite_untuk_Menganalisis_dan_Mengeksploitasi_Web_App_(en)&oldid=71139"