All language subtitles for 9. Information Gathering with Burp Suite

Another useful tool when it comes to Web applications is a tool called burp sweet.

Now let's go ahead and open up brb sweet so going to go up to the applications and in your favorite

should exist.

Burps sweet.

Here now Bert sweet is what we call a Web proxy.

Now Web proxy means that it has the capability of intercepting traffic for us and we're going to see

what that looks like.

So you're probably gonna get this error about this Jerry.

Don't worry about it.

We're just going to say OK you might get a you need to accept this license agreement when you first

started.

Go ahead and accept that as well.

And if you see an update screen go ahead and just close.

So we are on the community edition so we will have limited features.

We'll talk more about those when we get to the web application section but just want to introduce you

to what Bersih can do in a very basic form and how we can actually gather some information out of a

Web site from Herb sweet pretty easily.

So let's go ahead and just select temporary project and click next and then select start BIR.

Now the first thing that we're going to do is we're going to set up our Firefox for utilizing brb suite.

So go ahead and go to favorites in Firefox and I want you to go over to the right hand a little hamburger

here and you're going to go and select preferences

from preferences.

We're gonna scroll down all the way to the bottom and we're going to select settings.

Now we're going to select this manual proxy configuration here and we're going to say 1 2 7 0 0 dot

one port 80 80.

Later we get to the web application section.

I'll show you a much easier way of doing this would be tool called Foxy proxy.

But for right now this is a very high level overview.

So go ahead and use this proxy server for all protocols and that should fill in the rest.

Down here we're gonna go ahead and hit.

OK and we're going to leave this open I'll show you why in a second.

So I also want you to go to a new tab and I want you to go to h s double that slash slash burn like

this.

Now your first page might not show up like this.

It might show up with a you need to accept this certificate you're just gonna say allow down at the

bottom and say yes permanently store this exception and then you'll be brought to a screen somewhat

like this.

So what you're gonna do is you're gonna go ahead and just click on see a certificate here and then save

the file.

Mine is already saved as you can see in my downloads right here.

So what I'm going to do is we're going to go back into preferences once we have that saved and we're

going to go to privacy and security over on the left hand side.

We're going to scroll all the way down to the bottom and there is a view certificates but down here

and then we're gonna go ahead and just hit import your Downloads folder should automatically be selected

if not select download.

And then just select the CIA sir I.D. are hit open.

And then it's already installed for me.

But you will have to check boxes check both of those boxes and select OK.

And then it should now be imported for you.

So a couple of things to note.

Firefox sometimes changes things around.

I am recording this video in 2019.

If you watch it at a later time just be cognizant that in the General tab usually towards the bottom

is the network settings and the privacy and security settings usually contain the certificate.

So look around for those sometimes these move.

So from here let's go ahead and just see what we set up.

So I want you to go ahead and try to go to a Web site.

We can try to say Tesla dot com and it is going to stall out.

What is going on here.

So if we go over here we see this proxy tab is lit up in orange.

We're gonna go ahead and click on that and you could see that it's gathering some data here it's captured

and stuff from Firefox.

We've got more Firefox we can just click forward through this if we want and now we could see Tesla

starting to load and what we're doing is we're intercepting requests that Tesla is making out.

This to me looks like a API request or geo ip requests.

This might be geo location looking for a city.

So we're just clicking through clicking through all we're doing is capturing all different kinds of

traffic and we can modify this traffic say we have this request here you don't have to know what this

is right now but we have got this get request we can make this a poster class and for that and see what

happens.

I'm going to turn the intercept off.

I'm going to show you what's going on here so we can go over to the target and you can see all the pages

that have loaded in here.

This is all the traffic that has been intercepted so far since we ran Tesla.

So not only is Tesla running but you could see that it pulls a Google Analytics it pulls this secured

visit which looks like tracking as well it pulls DoubleClick which looks like maybe ads and then it

has an API running here as well.

So it's gathering all this traffic through.

But we're going to dig into this Tesla here and I just want to click on the first Ford slash and see

if there's a response to our request.

There isn't.

Let's go ahead and just look at maybe the.

Let's see if we click into one of these if we get a good response.

We don't.

Let's refresh one more time on the page.

You might even need to hit enter.

OK.

And sometimes it doesn't come through right away.

So let's go ahead and just click around.

There we go.

Do you see all this stuff coming through now.

That's more like it.

It wasn't taking everything up right away.

So what we can do is we can look at some of the things that just came through.

Like we just went to the Model 3 page.

So let's go ahead and click on this Model 3 and see what it's got for us.

So you can see that if we look at the request for this get Model 3 we made a GET request to Model 3.

And what's happened is we say hey I want to go out to this page.

Go ahead take me there and then we can view the response as well.

Now in the response we can get so much information.

Look at this.

We're seeing here that BHP seven point three point seven is running on the back end.

We can see a bunch of information here as well.

Drew Paul aid is running.

We identified that earlier but we're identifying it again.

We could see a lot of other stuff.

There's some weird things here going on too like there's a server name sitting in here.

Typically on an assessment this would actually be a finding a low finding but it's informational as

this is giving us information on possibly naming structure inside that network.

But they also have their own Tesla type header here.

So this is very unique for a client.

But what the point of the matter is here is that we can intercept a basic request in response and get

a lot of information through suite.

We're going to hit home on this really hard when it comes into the scanning and enumeration section.

And when we get into the web section as well.

But for now I just want you to take away that we've installed purposely and we can go out to a Web site

and I still define this as not active scanning.

There is a feature in brb suite that has active scanning that we could actually run but that is a brb

sleep pro.

So it has a vulnerability scanner built in you can see see up here upgrade to Bersih professional automatically

find vulnerabilities.

I have brb Sue pro it's four hundred dollars a year is absolutely fantastic.

Worth the money.

One of the few applications that I would recommend anybody buy.

But for the course I'm going to limit it to utilizing communication.

I will bring in pro sometimes as a show you some features but we're not going to worry about that.

So long spiel short I still feel that we are in step one here even though we are accessing the Web site

we're not doing anything very actively with scanning.

This is all very passive.

We're using traffic like a normal user would.

So you can see that we can intercept traffic and get a lot of information.

Again tools like appetizer look it pulls down the headers for us and it says hey it's running DHB seven

point three point seven.

It's running Drupal 8 whereas it getting that from.

Well it's getting it from these responses.

So it's pulling a lot of that down for us automatically.

But there's a lot of things that we can do when we get into Barb's suit as well.

So consider this just a mini introduction into the tool and then we'll touch back on it over and over

again as we go.

So this is it for this video.

We're going to get into some google fu in the next video and talk about social media as well.

So I'll see you in the next one.