Burp Suite

# RULES OF ENGAGEMENT (always re-read)
#   - In-scope:        only domains/IPs in the signed authorisation
#   - Activity:        agreed test types (input fuzzing, auth tests, etc.)
#   - Detection:       respect IDS; do not actively bypass without permission
#   - Reporting:       findings within 24h; severe issues within 1h
#   - Lab practice:    use OWASP Juice Shop / DVWA / PortSwigger Web Security Academy

# 1) Install — Community Edition is free + sufficient for learning
# https://portswigger.net/burp
#
# Start: Burp → Proxy → Options → Proxy listener (127.0.0.1:8080)
#
# Browser: configure proxy to 127.0.0.1:8080 OR use Burp's built-in browser
#   (recommended — pre-configured + isolated)

# 2) HTTPS intercepts — install Burp's CA cert in the browser/system trust store
#   Browser → http://burp → CA Certificate → download → import
#   System:  add to user trust store (NOT system — keep it scoped)

# 3) Proxy → Intercept ON — see + modify each request
#   - Click 'Forward' to pass through (possibly modified)
#   - 'Drop' to cancel
#   - 'Action → Send to Repeater' for manual replay
#   - 'Action → Send to Intruder' for fuzzing
#
# Keep Intercept OFF while browsing normally; turn ON when you're targeting a specific request.

# 4) HTTP History — full transcript of traffic
#   Filter by host (Settings → Filter), method, MIME type, status code.
#   Right-click any request → Send to Repeater / Intruder / Scanner.

# 5) Repeater — manual replay + edit
#   Edit any header / param / body, send, compare responses.
#   Use it to:
#   - Add / change Authorization header to test auth
#   - Tweak a query param to test injection
#   - Replay with different cookies to test session handling

# Example: test for IDOR
# Send GET /api/orders/100 in Repeater
# Change to /api/orders/101 — if you can read another user's order, IDOR confirmed.

# 6) Intruder — parameter fuzzing
#   Select positions (highlight values), then choose a payload list:
#   - Sniper:        one position at a time
#   - Battering ram: same value across all positions
#   - Pitchfork:     parallel — each position has its own list
#   - Cluster bomb:  full cartesian product (be careful — combinatorial explosion)
#
# Payload lists for common scans:
#   - SecLists/Discovery/Web-Content/common.txt — directory brute force
#   - SecLists/Fuzzing/SQLi/quick-SQLi.txt       — SQL injection probes
#   - SecLists/Fuzzing/XSS/xss-rsnake.txt        — XSS

# 7) Decoder — encode / decode in many formats
#   URL, HTML, base64, hex, gzip — paste in, decode through layers.
#   Useful for understanding obfuscated payloads + crafting your own.

# 8) Comparer — diff two requests / responses
#   Send two responses to Comparer to see EXACTLY what differs between
#   logged-in vs logged-out, or between two parameter values.

# 9) Scanner (Pro only) — automated active + passive scanning
#   Use ONLY with explicit authorisation; can generate hundreds of requests
#   that look like attacks to monitoring tools.

# 10) Match + Replace — auto-modify traffic
#   Proxy → Options → Match and Replace
#   Useful for: removing CSRF tokens to test exposure, swapping User-Agent,
#   injecting a custom header on every request.

# 11) Extensions (BApp Store)
#   - Autorize       — automatic authz testing across multiple roles
#   - Logger++       — better request history
#   - Turbo Intruder — high-speed fuzzing (Python scripts)
#   - JWT Editor     — decode / sign / re-sign JWTs
#   - Hackvertor    — payload transforms

# === Typical authorised workflow ===

# A) Recon — browse the app with Burp recording everything
#    History → see every endpoint the app actually calls.

# B) Map — Target → Site map → mark in-scope
#    Right-click target → 'Add to scope' to filter history + scanners.

# C) Authentication tests
#    - Replay login with valid + invalid + empty creds
#    - Try password reset flows (token reuse, token in URL, account takeover)
#    - Session fixation: log in, change auth cookie, see if app accepts

# D) Authorisation tests (IDOR, vertical escalation)
#    - Log in as user A → record id 42 endpoint
#    - Replay endpoint with user B's session cookie → should 404
#    - Try changing role params in PUT /api/users/me

# E) Input validation
#    - XSS, SQLi, SSRF probes — through Repeater first, Intruder for batch
#    - Test EACH parameter: query, form, JSON body, headers, cookies

# F) Business logic
#    - Negative quantities? Coupon stacking? Race conditions on checkout?
#    - Replay the same request 10x rapidly with Turbo Intruder

# G) Report
#    - Severity (CVSS or your firm's scale)
#    - Reproduction (URL, request, response, screenshot)
#    - Mitigation suggestion
#    - Affected versions / environments

# === Defender's mirror ===
#   - WAF rules + IDS for Burp signatures (User-Agent, Repeater patterns)
#   - Anomaly detection on request rate per endpoint
#   - Rate limits + bot protection on auth flows
#   - Honeytoken endpoints — record any hit
#   - Pre-prod automated security testing in CI (OWASP ZAP, Nuclei, custom)

# Burp Suite — the industry-standard web proxy.
# Workflow on AUTHORISED targets:
#   1) Configure browser to use 127.0.0.1:8080
#   2) Install Burp CA so HTTPS shows decrypted
#   3) Use Target/Site map → Proxy → Repeater → Intruder → Scanner
#   4) Save evidence per finding
# Community Edition is free; Pro adds Scanner + collaborator.