Burp Suite Extensions
5 likes•1,366 views
The document outlines various Burp Suite extensions focused on security testing, including tools like the replicator for generating proofs of concept, saml raider for SAML attacks, logger++ for logging requests and responses, and active scan++ for advanced scanning techniques. It details functionalities and methodologies for each tool, such as session macro creation and XML attack handling. Additionally, it highlights limitations and provides references for further exploration of these tools.
![SOFTWARE
VULNERABILITY
SCANNER
[VULNERS]
• Vulners Scanner
• Software Detection + Vulnerability
• Methodology: HTTP Response Header Based
Fingerprinting
• vulners.com search API
• CVEs, Advisories , Exploits!
• Caution: False Positives](https://image.slidesharecdn.com/burpextensionsv1-180528145532/85/Burp-Suite-Extensions-18-320.jpg)
Burp Suite Extensions
- 1. L E S S E R K N O W N BURP EXTENSIONS N E E L U T R I PAT H Y
- 2. MARKET • Replicator • SAML Raider • Logger ++ • Active Scan++ • WSDLER • Software Vulnerability Scanner • Backslash
- 3. REPLICATOR • Pentesting Focused • Replicate PoC for Developers • Used Twice > Before and After FIX Applied • One Vector Per Instance • Specially where encoding/fuzzing is involved • Developer: Should Understand it is just a PoC & can have variations • Finding Wise: User wise session macro
- 4. MODES TESTER MODE • Immediate PoC from Burp Suite • Input from Other Tabs > Replicator • Regex: Specify Expressions Manually • Create Session Macro • Scrub cookies • Test All • Save to replicator.json DEVELOPER MODE • Load replicator.json • Use inbuilt session macros • Works across Environments(dev, pre- prod, etc) • Clearing Cookies > Test All • Apply Fix • Test All
- 5. WHEN TO USE PROOF OF CONCEPT Team awareness: Developers, Test Teams, Security Testing As a substitute for documentation: Incremental testing LIMITATIONS Not Exhaustive: Cross Site Scripting, SQl Injections, Permutational Issues WAF in Place
- 6. DEMO
- 7. SAML RAIDER • Roland Bischofberger and Emanuel Duss • Security Assertion MarkUp Language • SSO and FEDERATED Logins • Assertions from IDP • XML Attacks(XXE, etc) • Signature Manipulation( Tampering Attributes, Replay, Re-signing, etc) • Certificate Striping • Issues: – Authentication, – Authorization Bypass – Privilege Escalation
- 8. S A M L S T R U C T U R E
- 9. ATTACK SURFACE Sign the Message Sign the Assertion Sign the Assertion and later sign the Message Tampering Public Keys and Certificat es Service Provide and Identity Provider
- 10. E X A M P L E S TA M P E R I N G S I G N AT U R E WRAPPING
- 11. LOGGER++ • Soroush Dalili & Corey Arthur • Log All You Want • Free • Also logs Sequencer, Spider, Intruder and so on.. • Save and Export as CSV • Grepping • Versatile Filters(Method, Query, Request, Response,…)
- 12. DEMO
- 13. ACTIVE SCAN ++ • James Kettle • Pro Burp Suite • Advanced Testing On Top Of Existing Active Scan • Esoteric Issues Deployment Pre-Requisites • Jython 2.5 or later • jython-standalone-2.5.jar • activeScan++.py
- 14. WHAT DO WE GET Struts2 RCE - CVE-2017-5638 / S2-045 Host Header Injection (password reset poisoning, cache poisoning, DNS rebinding) CVE-2014-6271/CVE-2014-6278 'shellshock' and CVE-2015- 2080, CVE-2017-5638, CVE-2017-12629 Edge Side Includes XML Input Handling Blind code injection via expression language, Ruby's open() and Perl's open()
- 15. DEMO
- 16. WSDLER • Eric Gruber • Parse WSDL • Operations, Bindings and EndPoints • Data Types Defined • Run Through Other Functions • Soap 1.1 Support Only
- 17. DEM O
- 18. SOFTWARE VULNERABILITY SCANNER [VULNERS] • Vulners Scanner • Software Detection + Vulnerability • Methodology: HTTP Response Header Based Fingerprinting • vulners.com search API • CVEs, Advisories , Exploits! • Caution: False Positives
- 19. O V E R V I E W
- 20. R E S U L T S
- 21. BACKSLASH POWERED SCANNER Research Grade Vulnerabilities High-Hanging Fruits Injection Vulnerabilities Input Filtering Red Teaming Avoiding WAF JSON injection to RCE Server-Side HTTP Parameter Pollution Eescape sequence injection
- 22. OTHER EX’S Heartbleed PHP Object Injection Check J2EEScan AWS Security Checks Java Deserialization Scanner RandomIP Address Header Decoder improved CMS Scanner Blazer
- 23. REFERENCES • https://portswigger.net/bappstore • https://github.com/nccgroup/BurpSuiteLoggerPlu sPlus • https://github.com/portswigger/active-scan-plus- plus • https://www.youtube.com/watch?v=dxo6-niEtyE • https://github.com/vulnersCom/burp-vulners- scanner • https://github.com/portswigger/logger-plus-plus • https://github.com/portswigger/saml-raider • https://portswigger.net/bappstore/9cff8c55432a4 5808432e26dbb2b41d8 • https://www.youtube.com/watch?v=EPmjl7q1- n4&list=PLuUtcRxSUZUpv2An- RNhjuZSJ5fjY7ghe&index=3