Results

PROFESSIONAL COMMUNITY

Scoping the effort to audit a website

Before you start testing, it's useful to estimate how much time and effort is required to audit the target website. These are some of the factors that have ...

PROFESSIONAL COMMUNITY

Mapping the visible attack surface with Burp Suite

To discover locations that are available to audit, you need to map the target application's visible attack surface. This refers to the endpoints that are ...

PROFESSIONAL COMMUNITY

Identifying reflected input with Burp Suite

Reflected input is when data is copied from a request and echoed into the application's immediate response. This is a prerequisite for a range of ...

PROFESSIONAL COMMUNITY

Determining the session timeout

When a user doesn't use an application for a certain amount of time, most applications will automatically log out the user and destroy their session. To ...

PROFESSIONAL COMMUNITY

Testing for SSRF with Burp Suite

Server-side request forgery (SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make requests to an ...

PROFESSIONAL COMMUNITY

Brute-forcing logins with Burp Suite

Although it's far more efficient to first enumerate a valid username and then attempt to guess the matching password, this may not always be possible. Using ...

PROFESSIONAL COMMUNITY

Getting started with the site map

The Target > Site map tab displays all the information that Burp gathers about websites. This information comes from a number of sources such as Burp ...

PROFESSIONAL COMMUNITY

Testing for reflected XSS manually with Burp Suite

Reflected cross-site scripting (or XSS) occurs when an application receives data in an HTTP request and includes that data within the immediate response in ...

PROFESSIONAL COMMUNITY

Testing for OS command injection vulnerabilities

OS command injection is a vulnerability that enables an attacker to execute arbitrary operating system (OS) commands on the server that is running an ...

PROFESSIONAL COMMUNITY

Having trouble downloading Burp's CA certificate?

In order to access http://burpsuite and download the CA certificate, your browser needs to be sending traffic through Burp's proxy listener. If you haven't ...