HackSmarter Web App Basics Course Review — Part 5 of many

Attention on deck crew! In today's article we will be exploring the next part of our ongoing review of the HackSmarter Web App Basics Course. This is where we dig a little deeper into the technical side in the exploration of a staple in the Web Application Testing space. The use of a web traffic interception proxy, starting with what many consider the industry standard — PortSwigger's Burp Suite.

This immediately leads to a shout-out to all the folks over at PortSwigger for this tool and for the plethora of free classes they have. I have only just started to scratch the surface on all that is available, but definitely recommend it as a way to get some free training: https://portswigger.net/web-security

Burp Suite is a proxy that sits between our web browser and the server holding the web application. In its simplest function, it allows us to intercept traffic between the two in the request/response cycle (discussed in part 2 of this series https://medium.com/@cpt_ron/hacksmarter-web-app-basics-course-review-part-2-of-many-9e0a79539b87?sharedUserId=cpt_ron). Further it allows us to modify this traffic to test for flaws.

There are others out there, one that is also very popular in the HackSmarter suite of education called Caido which will be the topic of my next article.

Tyler's lesson on Burp Suite focuses on two flavors and is probably best described from the table in the text of the course (screenshot of HackSmarter Web App Basics Course, section 4.1).

The first subsection is all about finding and running Burp Suite, which is a native binary on Kali Linux.

Tyler goes into how to make it more personalized to use from the User Interface.

Next, is an important part in setting up the Certificate Authority (CA) on the web browser that is being used to allow inspection of HTTPS traffic, though it also discusses how this can generally be avoided by using the on board Chromium browser from within the Burp Suite application. It already has this step completed for you.

If you have a preference for a different browser than Chromium you will need to follow this. Many Linux users prefer the more organic Firefox Browser, so if that is you, you'll want to pay close attention to this lesson. For Firefox they have a plugin called FoxyProxy that routes browser traffic through Burp once we add the CA Certificate from PortSwigger to allow the browser to accept HTTPS connections being inspected through Burp.

It also touches on one of the things that gets me occasionally to this day after almost a year of learning to use the intercept proxy tools. Remembering to turn off the proxy when using FoxyProxy and remembering to turn off the capture/halting function in the tool (known as Intercept on Burp Suite). These are often the source of whatever "why did my internet stop working" woes when using these tools. After many hours it is becoming a bit more second nature, but in the beginning was a bigger source of frustration…pain can be a great teacher.

The takeaway is before you call the Help Desk check to make sure you have these turned off first.

Next, Tyler goes in a little deeper into Burp Suite's user interface (UI), giving a good write up in the text below and demo in the video. Nothing profound or earth-shattering, but it is a good summary of the different functions for the new user to get started with or the older user to refresh on. It is good to note and is in this subsection that there is A LOT going on in Burp Suite's UI which can be overwhelming.

I find I usually only use about 5 of these routinely (Dashboard, Target, Proxy, Intruder, and Repeater) in the labs I hack on. This is as much in the realm of muscle memory as the teachers I have had along the way have their preferences for tools as I have developed my likes and dislikes as well over the past few years. I am sure all of these tools are important to gurus who understand them better, I am just not there yet.

We then get a little deeper into using Burp Suite with the long-established OWASP Juice Shop lab, which remains a great place to start learning web application vulnerability testing. In this case, it is literally to learn how to intercept and modify the web traffic using Burp Suite. This is also where we have our first challenge from Tyler, which in my opinion is one of the things that sets the HackSmarter learning system apart from others.

Tyler often throws his students into the deep end of the pool while holding a life ring in the form of a demo immediately following. As mentioned before, Tyler emphasizes a lot on trying things yourself (FAFO if you will, though Tyler more frequently keeps it in the PG with YOLO), breaking it/failing, researching yourself for the answer. After a while, I have found I don't want Tyler to tell me, I want to figure it out, then see if Tyler or any of the other walk-throughs on HackSmarter did it differently.

In the next subsection he goes over how to set scope so you are not intercepting a bunch of junk by setting scope. Filtering the Site Map and Proxy History helps limit what you see, but it does not necessarily prevent requests from being sent to out-of-scope systems. It is also hugely important to remember this in reference to scoping. We have to make sure we are only hacking the things we are allowed to. So even if you capture traffic that is out of scope, we can let it sail past without harassment.

Then we get into Fuzzing which is a bigger topic in PenTesting all together. In simple terms, fuzzing involves systematically supplying a variety of inputs to an application to observe how it responds, potentially revealing unexpected behavior or vulnerabilities. This is a popular mechanism in testing for directories and subdirectories in a web site, but also used in testing responses on a web application. Tyler's table on this does a much better job of describing than I ever could by writing it out (screenshot from Foundations of Web App Pentesting course section 4.6).

Finally, Tyler goes into exploring the extensions on Burp Suite which allow for customization and expansion of capabilities in the tool. There are too many to even begin to go into depth on, but Tyler mentions a few specifically and again his table better illustrates than I could typing it out (screenshot from Foundations of Web App Pentesting course section 4.7).

Whew mates! That was quite a bit to map out, but rest assured, after this class I felt more confident in the basic use of an industry PenTesting staple. This continues with future lessons in the Foundations of Web App Pentesting course on the HackSmarter platform. If you are a new PenTester or even someone who has done this for years there are plenty of things to learn or refresh on. As with all of the courses I have done on HackSmarter, I highly recommend it.