Where can I find a solid BURP tutorial?

Question

I'm looking for a good resource for learning/configuring BURP. I understand the concepts behind using the framework, and have read the docs on the site, but if anyone has a solid tutorial link I would love to see it. I would've made this a wiki but I'm not looking to compile a large resource, I just want a couple solid links and I will close the question.

Links to preconfigured BURP setups are also appreciated.

To specify a bit further, I'm particularly interested in the ideal setup for manual spidering, as I prefer the stealthiness and the ability to control vs. flooding tons of pages.

BURP is simple - just swallow some air and wait for it to come up. ;-) — Iszi, Feb 24 '11 at 15:41
As a word of caution, if you don't use BURP suite early on to catch security mistakes, you'll probably find yourself using the Forensic Analysis and Response Toolkit to deal with the unpleasant aftermath. [*ducks*] Come on, you know you were thinking it. — tylerl, Oct 08 '12 at 05:47

David Stubley · Accepted Answer · 2011-02-25T08:57:33.170

Along with advice on how to use Burp, you should also not forget to customise the following:

Form Submission:

To set suitable names and values for forms submitted by Burp, as I presume you don't want to send 'Weiner' :-)

Within the Burp window - navigate to the 'Spider' tab and then the 'options' menu. From here you should update the standard values within the forms section:

Form

Click on each value and select 'edit', change the value and then click on the 'update' field before selecting the next value:

Update

Payload:

You can also edit the default payloads that are used within Burp. This can be done by unpacking the .jar file. This example uses 7Zip to unpack the latest Burp file.

Firstly right click on the .jar file and select open with 7Zip. This will show:

7zip

Then open up burp\PayloadStrings\:

strings

From this folder, select fuzzing - full.pay. Within this file you will see options that can be configured to your specific needs (highlighted in the following image):

payload

Spider:

For manual spidering then Burps own help page has the following advice:

passively spider as you browse - If checked, Burp Spider will process all HTTP requests made through Burp Proxy, to identify links and forms on web pages visited. Using this option can enable Burp Spider to build up a detailed picture of an application's contents even when you have only browsed a subset of that content with your browser, because all content that is linked from visited content is automatically added to the Suite site map.

This is done by visiting the 'Spider' tab and then selecting the 'options' tab:

spider

This way, you control the generation of the site map without flooding the host with traffic.

Hope this helps.

I knew about the form submission portion, payload customization in the jar was something I hadn't had a chance to check out yet, very cool. I would accept this, except there wasn't an include for steps to properly capture manual spidering, could you add that? I appreciate you taking the time for screenshots and all, nice post +1 — mrnap, Feb 25 '11 at 04:35
I have added some further information around manual spidering with Burp. — David Stubley, Feb 25 '11 at 08:57

score 8 · Answer 2 · answered Aug 08 '11 at 07:18

Absolutely absolutely pick up the Web Application Hackers Handbook by Portswigger (author of Burp), which is written as both an introduction to the concepts relevant to Web App reversing / hacking, but also as a step-by-step guide for applying those concepts with Burp Suite.

Note that the Second Edition is now available.

score 6 · Answer 3 · answered Feb 23 '11 at 21:37

6

One good sequence of tutorials I've seen is on the Security Ninja site. That links got the last one in the series (focuses on the scanner tab) but there's links to the other ones from that page.

answered Feb 23 '11 at 21:37

Rory McCune

60,923
14
136
217

Nice link, I'm in the process of reading it all +1 – mrnap Feb 25 '11 at 04:36

score 2 · Answer 4 · answered Feb 23 '11 at 21:46

2

This one from SalesForce seems okay - a wee bit basic if you have used burp before.

answered Feb 23 '11 at 21:46

Rory Alsop

61,367
12
115
320

score 0 · Answer 5 · answered Nov 01 '12 at 19:37

0

In version 1.5 Burp contains solid built-in help that can be used as tutorial. It's accessible via Help -> Burp Suite Help

answered Nov 01 '12 at 19:37

Andrei Botalov

5,267
10
45
73

Where can I find a solid BURP tutorial?

5 Answers5

Form Submission:

Payload:

Spider:

Linked