Burp Suite

Burp Suite

Logo of PortSwigger, the company that develops Burp Suite
Developer(s)	PortSwigger
Stable release	2024.10.3 [1] / 29 November 2024;2 months ago (29 November 2024)
Written in	Java
Type	Security testing
Website	portswigger.net/burp

Burp Suite is a proprietary software tool for security assessment and penetration testing of web applications. ^{[2] [3]} It was initially developed in 2003-2006 by Dafydd Stuttard ^[4] to automate his own security testing needs, after realizing the capabilities of automatable web tools like Selenium. ^[5] Stuttard created the company PortSwigger to flagship Burp Suite's development. A community, professional, and enterprise version of this product are available.

Notable capabilities in this suite include features to proxy web-crawls (Burp Proxy), ^[6] log HTTP requests/responses (Burp Logger and HTTP History), capture/intercept in-motion HTTP requests (Burp Intercept), ^[7] and aggregate reports which indicate weaknesses (Burp Scanner). ^[8] This software uses a built-in database containing known-unsafe syntax patterns and keywords to search within captured HTTP requests/responses. ^[9]

Burp Suite possesses several penetration-type functionalities. A few built-in PoC services include tests for HTTP downgrade, ^[10] interaction with tool-hosted external sandbox servers (Burp Collaborator), ^[11] and analysis for pseudorandomization strength (Burp Sequencer). ^[12] This tool permits integration of user-defined functionalities through download of open-source plugins (such as Java Deserialization Scanner ^[13] and Autorize ^[14] ).

Features

As a web security analyzer, Burp Suite offers several built-in features designed to assist testers in auditing their web applications.

Community Edition

BurpSuite Community Edition

The Community Edition version of Burp Suite includes the following features. ^[15]

• Burp Proxy and Interceptor: Like other web application security scanners, one of the primary functionalities behind Burp Suite is its capability to act as a proxy server for client-side HTTP requests. ^[16] Penetration testers can intercept web servers' default HTTP requests variables (attributes, body parameters, cookies, headers) in real-time and edit these values on-the-fly. ^[17]
• Burp Site Map: BurpSuite operates similarly to the OWASP ZAP software, wherein target URLs' site maps ^[18] can be captured either through automatic or manual web-crawling. ^[19] When users crawl through a web application, HTTP requests become sent to a web proxy in Burp Suite's software. Once HTTP requests/responses are captured, these endpoints can be investigated manually or audited automatically through features in Burp Suite's Professional edition.
• Burp Logger and HTTP History: Retains a list of HTTP requests/responses captured during web-crawling (and automated scanning for Professional edition). ^{[20] [21]}
• Burp Repeater: Repeats captured HTTP requests, allowing custom changes to request variables. ^[22] Customized HTTP requests can be sent in quick succession and can be used to exploit race condition vulnerabilities. ^[23]
• Burp Decoder: Automates text decoding. ^[24] Decoded text can then be edited and re-encoded, allowing for enhanced customization in web requests. Currently, Burp can encode and decode in HTML, URL, Base64, ASCII hex, Hex, Octal, Binary, and GZIP. Burp’s “smart decode” will automatically detect encoded data and recursively decode it as much as it can. ^[25]
• Burp Sequencer: Analyzes an application-generated token variable across repeated HTTP requests to determine pseudorandomness predictability strength.
• Burp Comparer: Allows users to compare content found between two different HTTP requests or HTTP responses. ^[26]
• Burp Extender: See the Burp Extender section below; certain Burp Suite plugins are limited to only interact with Professional edition. ^[27]

Professional Edition

Burp Suite's Professional edition includes all Community features plus those listed below.

• Burp Scanner: Automates report auditing and/or web crawling for HTTP captured requests/responses. Uses internal rules to audit contents from intercepted HTTP responses in order to search for vulnerable response values. Capacitates users to customize scanners' speeds and findings coverage.
• Burp Dashboard: Displays findings results and categorizes issues based on severity. ^[28] Detailed descriptions and remediation steps may be provided based on what type of finding. ^[29]
• Burp Intruder: Similarly to Burp Repeater at a broader extent, grants users the means to send multiple parallel HTTP requests with changes to specified request variables. ^[30]
• Burp Collaborator: Simulates C2 Server hosting to attempt external service interaction and Out-of-Band attacks. ^[31]
• Burp Organizer: Allows users to curate selected HTTP requests/responses into a saved collection. ^[32]
• Burp Infiltrator: An IAST agent scripted to automate interactive/runtime scanning and communicate results through the Burp Collaborator feature. ^[33]
• Burp Clickbandit: A tool to concept proof to test clickjacking attacks against web applications' front-end HTML and JavaScript files. ^[34]
• File Saving: Professional edition allows users to save their projects as ".burp" files. ^[35]

Burp Extender

BApps Burp Suite offers an extension store ^[36] where users can upload and download plugins for functionalities not supported natively. Different plugins alter in functionality, ranging from adjustments for UI readability, additions to scanner rules, and implementations of new analysis-based features.

Burp Suite's extension API is open-source. ^{[37] [38]} Support for Java plugins is natively supported, while extensions which use Python and Ruby require users to download JAR files for Jython and JRuby respectively. ^[39]

Many Burp plugins have also been created by Portswigger employees as a means of developing proof-of-concepts for research conducted by the company. ^[40] Examples of these include extensions created by James Kettle, Portswigger's Director of Research, ^[41] including Backslash Powered Scanner, ^{[42] [43]} Param Miner, ^{[44] [45]} and HTTP Request Smuggler. ^{[46] [47]}

BChecks

BChecks were added to Burp Suite in June 2023 ^[48] as a means of permitting users to create and customize their own scanner rules. ^[49] A curated collection of BChecks are maintained by Portswigger through an open-source GitHub project. ^[50]

Bambdas

Users can write Java scripts to create custom HTTP request/response index filtering in Burp Suite's proxy HTTP History, WebSocket History, and Logger lists. ^{[51] [52]}

See also

• Application security
• Dynamic Application Security Testing (DAST)
• Vulnerability Assessment (Computing)
• Information technology security assessment
• OWASP ZAP
• Web Crawler
• Web Proxy Servers

References

1. "Professional / Community 2024.10.3 | Releases" . Retrieved 30 November 2024.
2. Rahalkar, Sagar Ajay (2021). A Complete Guide to Burp Suite: Learn to Detect Application Vulnerabilities. Apress. ISBN   978-1-4842-6401-0.
3. Lozano, Carlos A.; Shah, Dhruv; Walikar, Riyaz Ahemed (2019-02-28). Hands-On Application Penetration Testing with Burp Suite. Packt Publishing. ISBN   9781788995283.
4. PortSwigger. "About". PortSwigger. Retrieved 2024-07-09.
5. PortSwigger (9 July 2020). "Ask me anything, with Burp Suite creator Dafydd Stuttard". YouTube. Retrieved 2020-07-09.
6. Rose, Adam (21 April 2023). "Proxy VM Traffic Through Burp Suite". FortyNorth Security. Retrieved 2024-07-09.
7. Setter, Matthew (6 December 2017). "Introduction to Burp Suite". Web Dev With Matt. Retrieved 2017-12-06.
8. Lavish, Zandt. "Intro to Burp Suite Automatic Scanning". GreatHeart. Retrieved 2022-07-12.
9. Shelton-Lefley, Tom. "Web Application Cartography: Mapping Out Burp Suite's Crawler". PortSwigger. Retrieved 2021-03-05.
10. PortSwigger. "HTTP/2 Normalization in the Message Editor". PortSwigger. Retrieved 2024-07-09.
11. Stuttard, Dafydd. "Introducing Burp Collaborator". PortSwigger. Retrieved 2015-04-16.
12. Stuttard, Dafydd. "Introducing Burp Sequencer". PortSwigger. Retrieved 2007-10-21.
13. "Java Deserialization Scanner". GitHub. Retrieved 2024-07-09.
14. "Autorize". GitHub. Retrieved 2024-07-09.
15. ""Burp Suite : Home page"". portswigger.net. Retrieved 2016-02-24.
16. PortSwigger. "Proxy". PortSwigger. Retrieved 2024-07-09.
17. Setter, Matthew (9 February 2018). "How to Intercept Requests and Modify Responses With Burp Suite". YouTube. Retrieved 2018-02-09.
18. "Burp Suite 101: Exploring Burp Proxy and Target Specification". Hacklido. 15 October 2023. Retrieved 2023-10-15.
19. PortSwigger. "Full Crawl and Audit". PortSwigger. Retrieved 2024-07-09.
20. Aggarwal, Sahil (11 January 2023). "BurpSuite Logger Secrets for Pentesters". CertCube Blog. Retrieved 2023-01-11.
21. Pradeep. "Filtering Burp Suite HTTP History". Study Tonight. Retrieved 2023-06-02.
22. TryHackMe. "Burp Suite Repeater". TryHackMe. Retrieved 2024-07-09.
23. "Race Conditions". PortSwigger.
24. Chandel, Raj (24 January 2018). "BurpSuite Encoder Decoder Tutorial". Hacking Articles. Retrieved 2018-01-24.
25. "Burp Decoder". PortSwigger. December 19, 2024.
26. Salame, Walid (9 April 2024). "How to Use Burp Decoder". KaliTut. Retrieved 2024-04-09.
27. PortSwigger. "Installing Extensions". PortSwigger. Retrieved 2024-07-09.
28. PortSwigger. "Dashboard". PortSwigger. Retrieved 2024-07-09.
29. PortSwigger. "Vulnerabilities List". PortSwigger. Retrieved 2024-07-09.
30. FireCompass (31 October 2023). "Mastering Burp Intruder Attack Modes". FireCompass Blog. Retrieved 2023-10-31.
31. PortSwigger. "OAST". PortSwigger. Retrieved 2024-07-09.
32. PortSwigger. "Organizer". PortSwigger. Retrieved 2024-07-09.
33. Stuttard, Dafydd. "Introducing Burp Infiltrator". PortSwigger. Retrieved 2016-07-26.
34. Roof, Zach. "Learn Clickjacking With Burp Suite". Teachable. Retrieved 2024-07-09.
35. PortSwigger. "Manage Project Files". PortSwigger. Retrieved 2024-07-09.
36. PortSwigger. "BApp Store". PortSwigger. Retrieved 2024-07-09.
37. PortSwigger. "Creating Extensions". PortSwigger. Retrieved 2024-07-09.
38. "Burp Extensions Montoya API". GitHub. Retrieved 2024-07-09.
39. "TryHackMe Burp Suite Extensions". Medium. Retrieved 2024-03-21.
40. PortSwigger. "Research". PortSwigger. Retrieved 2024-07-09.
41. PortSwigger. "Meet the Swiggers: James K". PortSwigger. Retrieved 2024-07-09.
42. "Backslash Powered Scanner". GitHub. Retrieved 2024-07-09.
43. Kettle, James. "Backslash Powered Scanning: hunting unknown vulnerability classes". PortSwigger Research. Retrieved 2016-11-04.
44. "Param Miner". GitHub. Retrieved 2024-07-09.
45. Kettle, James. "Practical Web Cache Poisoning". PortSwigger Research. Retrieved 2018-09-09.
46. "HTTP Request Smuggler". GitHub. Retrieved 2024-07-09.
47. Kettle, James. "HTTP Desync Attacks: Request Smuggling Reborn". PortSwigger Research. Retrieved 2019-09-07.
48. PortSwigger. "Professional Community 2023.6". PortSwigger. Retrieved 2024-07-09.
49. "Use BCheck to Improve Vulnerability Scanning". YesWeHack. Retrieved 2023-09-01.
50. "BChecks". GitHub. Retrieved 2024-07-09.
51. Stocks, Emma. "Introducing Bambdas". PortSwigger. Retrieved 2023-11-14.
52. "Bambdas". GitHub. Retrieved 2024-07-09.

External links

• Official website