Getting Started with Burp - Part 4: The Repeater Tab

-
In my fourth post, I will spend a little time talking about the Repeater tab. Repeater is somewhat similar to the proxy tab in that it allows you fiddle with HTTP requests, but it is better because it allows you to change and repeat requests over and over again without the need to flip back and forth between the browser. I have found that I spend a great deal of time in this tab, usually after I have tested something in the Proxy tab. In my experience, Repeater is one of the most useful tabs in the Burp suite.

 Let's take a look at how to use Repeater when testing our test JuiceShop site.
  1. In Burp, go to the Proxy tab and make sure that the intercept option is set to “on."

  2. With your browser running through Burp Suite, go to https://sf-owasp-juiceshop.herokuapp.com/#/contact. Fill out the form and submit it.

  3. Note the ‘comment’, ‘rating’, and ‘captcha’ parameters in the request. Don’t make any changes to the parameter values yet. Forward the request on to the server and change the intercept option to “off."

  4. In Burp, click the History sub-tab found inside the Proxy tab.

  5. Find one of the POST entries hat contains sf-owasp-juiceshop.herokuapp.com. Right-click on the entry and click “Add to scope.”

  6. Click on the Filter bar that is located above the History pane. In the window that appears, choose “Show only in-scope items.” This will eliminate any other out-of-scope requests and responses from showing up in the history.



  7. Find the form POST from step 2 in the proxy history. Once found, right-click it and choose Send to Repeater.

  8. Click on the Repeater tab. You will see a “Request” and “Response” window. In the left window, you will see the request and the parameters noted in step 3. Modify the rating number to “rating” : 6. Click the Go button to submit the request.

  9. Note the Response tab. Some JSON data is returned by the server. Was the submission successful? How do you know?

  10. What else could you do with repeater? Why is this easier than working manually in the Proxy tab?

Comments

Post a Comment

Popular posts from this blog

OWASP ZAP Tutorial - Part 2: Crawling

-
Image
If you completed part one of this series, you have now successfully intercepted an HTTP request and response with OWASP ZAP. Don't you feel proud and empowered? I knew you would. But guess what? We're not done yet... not by a damn site. Now it's time to learn how to  crawl  a web application with ZAP. Now I know what you're thinking to your self. Your thinking, "Pablo, why do I need to crawl the site? Can't I just do an outright scan? Won't that crawl the site first anyway?" Well, the answer to your question is "yes," you can just scan the site, which usually starts with a crawl. But here is the deal, maybe you don't want to be noticed, especially if you are doing a test where stealth is important. Have you ever worked on a blue team and had your email inbox explode with alerts because some jackhole decided to scan your company's website? If so, then you understand why running a full scan might not be desirable (you may also wa
Read more

OWASP ZAP Tutorial - Part 1: Intercepting Traffic

-
Image
So you want to use OWASP's Zed Attack Proxy to intercept web requests and responses, but you don't know where to start. ZAP isn't quite as pretty as Burp and there isn't even a proxy tab that you can use to intercept traffic and monkey with the parameters! What is the deal!? OK, OK, OK, just take a chill pill there my friend. Although ZAP is a little different from Burp, I think you will find that it is just as useful, and in some cases perhaps more so. Let's jump in with a little exercise that will help you figure out the basics of this often overlooked gem. Before going any further, I am going to take a moment to warn you about testing web applications without permission; don't do it. Testing a site that is not yours is what a friend of mine has referred to as a "non-extradition country career choice" (thanks Adrien de Beupre). Equador is a lovely country, but you probably don't want to live there. Manually Intercepting HTTP Requests and
Read more

OWASP ZAP Tutorial - Part 3: Scanning

-
Image
Good day, eh. Welcome to Part 3. In this post, we will spend a little time walking through how to perform active scanning with ZAP. I'm gonna level with you, this is probably the easiest part of workin with ZAP, but it is also the most perilous. Web scanners have taken down sites, and if the scope isn't configured properly you could find yourself winning an extended stay at Club Fed (located in beautiful Leavenworth, Kansas). As always, don't scan stuff that isn't yours or that you don't have permission to scan. Got it? Good. Let's move forward. As you may or may not know, OWASP ZAP can perform two different levels of scanning: passive scanning and active scanning. Our tutorial will focus on active scanning, but I think it is worthwhile to have a brief discussion about passive scanning. Passive scanning is the scanning that takes place when ZAP is interacting with a web application through any other process other than an active scan. What this means is that
Read more