May 17, 2021

What's happening in the Burp-verse - Issue #6

By Burp Suite Guide • Issue #6 • View online

Hello Burp Suite heroes 👋,

I hope you and your family got vaccinated and are doing good.

This newsletter issue was made possible because of your love, support, and feedback. To appreciate that, I have added a surprise with this newsletter issue.

Read till the end to find it out 😉.

If you got this newsletter for the first time, welcome onboard!!! Signing up for the newsletter was your first step in becoming the up-to-date hero of Burp Suite.

Now let’s continue.

Releases

Burp 2021.5.1 released

This stable release contains massive updates to Intruder. Check out newsletter issue #5, where I described some of those updates.

Blog Posts

Headless Unattended Scanning in Burp Suite with Seltzer

To describe Seltzer extension is one line, I would say it’s like Carbonator extension for Burp 2.0. As Carbonator is no longer maintained and doesn’t support some Burp 2.0 features, I wouldn’t be wrong if I tell Seltzer is the proud successor of Carbonator.

Seltzer is a wrapper around Burp’s REST and can launch Burp scans from the command-line. It’s easy to use and can help Burp Suite fit into your CI pipelines for DAST scanning.

To know more, read the article.

Overcoming Issues Using Custom Python Scripts with Burp Suite Professional

This article by JumpSec Labs introduces you to the Python Scripter extension and some sample scripts to alter HTTP requests (GET and POST).

I feel the Hackvertor extension can tackle some scenarios described in the article. But if you want more flexibility and logic-based request modification, then Python Scripter might be the extension you are looking for.

To know more, read the article.

Extensions

HTTP Methods Discloser by Ashkan Jahanbakhsh

This extension makes an OPTIONS request and determines if any other HTTP methods are available. If available, highlights the request in the Burp Proxy tab and comments the HTTP methods.

xxux11 ᯲ ̸ on Twitter

“HTTP Methods Discloser in burp

Download link: https://t.co/PpBEwMrhPp
or wait for @PortSwigger to publish it in BApp Store #bugbountytips #Burpees”

twitter.com • Share

AES Killer by Abdul Wahab

A simple yet powerful extension by Abdul Wahab (from Ebryx) helps decrypt AES encrypted traffic on the fly. This extension requires the secret key and initialization vector for the traffic to be decrypted/encrypted.

Once configured, the extension takes care of all the encryption and decryption in the background, and you can continue fuzzing the plain decrypted text in Burp Repeater and Intruder.

Read AES Killer - Usage Guide to know more about the extension.

Source: https://n00b.sh/posts/aes_killer-usage-guide/

Tweets

Burp Suite has made HTTP/2 the default protocol to use (starting from v2021.4.2). While it helps connect with new web servers, fasten intruder bruteforce and active scans, this setting seems to have some issues.

sanjay on Twitter

“For people who downloaded the latest version of BurpSuite.. they have added support for HTTP/2.

By default it will enable HTTP/2, so if the web app you’re trying to MITM doesn’t support HTTP/2 then you will get this error message.

I spend lot of time trying to figure this out”

twitter.com • Share

Burp Suite extension “Turbo Intruder” doesn’t seem to support HTTP/2.

Akash Hamal on Twitter

“Burp Suite extension “Turbo Intruder” doesn’t support HTTP/2 (http version 2) and it will throw 400 bad request. But u can change http version to 1.1 from request and run attacks! :)

bugbountytip #BUGBOUNTY”

twitter.com • Share

Rohit has started #BurpHacksForBounties series where he shares a Burp hack each day. Click on the above Twitter hashtag to see his recent tweets.

Rohit on Twitter

“🚨🚨 I am starting the #BurpHacksForBounties series for 30 days, each day will share a Burp hack, which makes my working with @Burp_Suite easier.

Starting Monday. Stay tuned.

They will not be the ones you find on the internet 😉😉

infosec #appsec #bugbounties #bugbountytips”

twitter.com • Share

Others

Experience Burp Suite Enterprise Edition in a new live demo

I always wanted to give Burp Suite Enterprise Edition a try - see how it works (security scan multiple websites and manage it) along with its look and feel. But every time I planned to request a trial, I would procrastinate. 🤦‍♂️

Portswigger has made it even easier to see how Enterprise Edition looks like. You obviously cannot start a scan on your websites; however, you can see the different features in Burp Suite Enterprise.

https://enterprise-demo.portswigger.net/

If you liked it and want to see it in full action, request a trial.

Finally

Thank you for subscribing to my newsletter. You made it possible for this newsletter to cross the 100 subscribers milestone!!! 🎉 🎉

So I am giving away the “Hands-On Application Penetration Testing with Burp Suite” book for free to a lucky subscriber. This book is by far the most recent and knowledgeable book on Burp Suite.

You are just two steps away from winning this book. To participate in this giveaway:

Make sure you follow Burp Suite Guide on Twitter & LinkedIn
Tweet (on Twitter) or post (on LinkedIn) why you liked this newsletter and why others should subscribe to this as well.

Don’t forget to add the link https://newsletter.burpsuite.guide/ and the hashtag #burpsuiteguide

The winner will be announced in 2 weeks. Hurry up!!

Looking forward to giving you this amazing book.

Until next time 👋

Did you enjoy this issue?

By Burp Suite Guide

Your guide to all things Burp Suite !

Tweet

Share

In order to unsubscribe, click here.

If you were forwarded this newsletter and you like it, you can subscribe here.