- [Instructor] One of the types of the most used tools
for hacking web applications, by far,
are proxies, or web proxies.
And, basically, what a web proxy is,
I'm gonna put here P, for short,
is a piece of software that sits between your web browser,
and the web application,
and intercepts all the transactions
between the client or the web browser,
and the application for you to be able to inspect,
modify or delete any types of transactions.
And, by far, one of the most popular proxies is Burp Suite.
And Burp Suite is, basically, a series of tools
that include a proxy, or proxy capabilities,
within the environment.
And as you see him here,
you can actually intercept transactions
between a web client, or a web browser,
and a web application.
Later, we're are gonna be using Burp Suite
to launch different types of attacks,
and to find different vulnerabilities,
like cross-site scripting, cross-site request forgery,
SQL injection, and many more.
Now, there are a few ways
that you can set up your environment
to intercept transactions between the web browser
and the web application using Burp Suite.
The easiest way is by using the built-in browser
that comes with Burp Suite.
So, if you go under Proxy Intercept,
you see that, in here, you can click on Open Browser,
and it will open a Burp Suite browser.
At the end of the day, it is actually Chromium,
that is built-in within the application.
Now, another way is that you can use other browsers,
such as Firefox, that comes with Parrot and Kali Linux,
and you can go under Preferences,
scroll all the way down onto Network Settings,
and in there, you can set the manual proxy configuration
for your loopback IP address,
So 127.0.0.1, on Port 8080,
which is a default port that Burp Suite is configured
to perform the proxy transactions.
Now, in this case, I'm setting up for HTTP proxy.
You can also use proxy settings for FTP and HTTPS,
if you so desire.
And, if you click on Okay, of course,
all the transactions between the web browser
and the web application will be intercepted by Burp Suite.
Now, in this case,
I also have installed an add-on or an extension
to my web browser, called FoxyProxy,
and I already have it configured here, for Burp,
and I wanted to be a little bit more creative,
and I put Burp lit, so 1337,
but if you go under Options,
and I'm gonna go into Edit.
Of course, I've already had an entry,
but you can create an entry, and name it as you will.
In this case, I actually have it pointed also
to 127.0.0.1, on Port 8080.
We don't need a username and password,
and I will save those settings.
Now, if I actually go and turn on Burp, or turn it off,
turn on the proxy, by any means, and turn it off,
it's a lot easier than navigating to Preferences,
and then, if you want to stop the transactions
from going to the proxy,
it's a more lengthy way to actually,
go all the way to Settings again,
and then, of course, to disable a proxy this way.
But once again, one of the best or easiest way,
is actually to use the built-in browser.
Now, in this case, just to provide a very quick example
on how to intercept transactions between this web browser
and the web application using Burp Suite
I'm gonna navigate to an intention of vulnerable application
that I have in my environment,
in the Weblo labs environment
that I mentioned earlier.
And in this case, I'm pointing it to 10.6.6.23
which is an application called Gravemind.
But as you see, nothing is displayed in the browser because,
Burp Suite is actually intercepting the transactions.
And you see here that I actually,
I am intercepting that transaction.
I can click on Forward.
And when I do that,
you see that the page is actually being populated.
Every time that I click on something or that I navigate
or refresh, you will see that the transactions
are intercepted with the proxy.
You can also look at the HTTP history
to see any other transactions that we have concluded before.
And you see that had a lot of them
with different applications in there, right?
Some of them actually are part of a little bit of fuzzing
that I was actually doing.
And I'm gonna cover what fuzzing is a little bit later
in the presentation, and in this course.
Now, let's go over another proxy that you can use.
And it's actually a series of tools as well,
not only a proxy, that is called the OWASP.
So the Open Web Application Security Project,
Zed Attack Proxy or ZAP, and you can navigate in Parrot,
to pen testing web application analysis,
and a launch OWASP from there or from the command line
is the command line is zaproxy.
Let's actually launch it real quick.
And in this case, I am not gonna persist this session
at this moment, I'm just gonna start the application.
And basically unlike Burp,
this is an open source and free application.
Now, Burp Suite,
the one that we were discussing before,
comes in two different versions, a community edition,
that's the one that I was actually using,
and a professional version that you have to pay.
And one of the differences
between the community edition of Burp,
and the professional edition,
is the ability to do automatic scanning,
and of course a whole bunch of additional plugins,
and features as well.
Now, in this case, the OWASP Zed Attack Proxy, or ZAP,
it's an open source and free,
and it's an amazing OWASP project,
on where allows you to do automated scanning, right?
So if I wanted to actually point this
to the same IP address, that we were navigating before,
I can launch an attack,
or I can launch basically an automated scan,
just by clicking an Attack here.
Now there's different modes that I can launch that attack,
like Protected, Standard, ATTACK Mode, and so on.
I'm just gonna leave it into Standard Mode.
And I'm gonna launch this at quote unquote attack.
And basically what it's doing,
is actually is navigating through
all the different constructs of the application,
and then is also allowing
to potentially find different vulnerabilities.
And in that case, you will see them in Alerts.
Now so far it hasn't found a lot of the vulnerabilities
in there yet, and this can take a few minutes
depending on how big the application is.
So in some cases, even an automated scan can take hours.
No, this one is a very, very simple web application
that I have here for you to practice in your own skill.
Now, in this case, this is a very simple web application
that I have for you to practice your skills
in a safe environment with Weblo labs.
In many cases actually a lot of these applications,
actually can take a significant amount of time.
Now, as far as the actual proxy itself,
you can turn on intercept basically,
and set breaks into all the requests and responses.
And basically you can literally see the request
and the response in the window that I'm showing here.
And you see that, of course,
you can get very detailed information
about all the transactions that are happening
between your web browser.
In this case actually narrowed scan, right?
But you can do it within your web browser
and the web application.
Now, there are also a few other open source web application
vulnerability scanners that are very popular
in the community.
And one of them is called Nikto.
And Nikto is a command light scanner
to a web application and find different misconfigurations
or vulnerabilities.
And also you can do a little bit of reconnaissance
and find different directories and interesting files
that you may then combine and deep dive using other tools
like Burp Suite, and so on.
Now, in this case, what I'm going to do,
is I'm gonna point Nikto to the same web application
that we were just navigating before.
And as you see, it automatically within just a few seconds
found that is running nginx.
And is running this older version of nginx, a 1.14.2.
And it actually found a few different directories,
like admin, wp admin, wp login, and so on.
So this just took a few seconds.
And as you see, some of these tools can be fairly powerful
on doing enumeration and fuzzing,
and of course, finding different vulnerabilities.
Like for example, it found that it did not have
any cross-site scripting protection headers,
and also a few configurations for anti-clickjacking
are not present in the web applications.
Later in the course, you're gonna be learning about
how to analyze web applications,
how to do additional footprinting,
and how to find these type of vulnerabilities,
and what these vulnerabilities are all about.
Now, later in the course, you're gonna be learning about
how to analyze web applications a little bit further,
also how to bypass client side controls,
how to find vulnerabilities like cross-site scripting,
cross-site request forgery, clickjacking,
and also how to do additional footprintings
of web infrastructures and web applications.