South Dakota Information Security

This is the second post in Burp tutorial, and in it I will discuss the Target and Spider tabs and their functions. I will also give you a short exercise that will help you understand some of these functions. The Target tab is the default interface when Burp starts and it has two sub-tabs: Site Map and Scope. The Site Map tab displays sites that have been proxied by Burp and it details the identified structure of those sites. This tab is broken into three different panes: the site map window (left side), the connection history window (top right), and the request/response pane (bottom right). The second sub-tab in Target is the Scope tab, and it allows the user to add and remove URLs from the scope. Setting changes made in this interface affect the rest of the application. When working in Burp, one of the first things you should do is set the scope of your test. This will help prevent you from testing applications which you do not have permission to test. Setting the Scope and Filt...

Well, here we are. I recently needed a presentation for the December 2018 OWASP Sioux Falls chapter meeting, and I thought to myself, "Self, you should talk about interception proxies, specifically ZAP an Burp." If you aren't familiar with interception proxies, they are tools that are designed to intercept, analyze, and manipulate web requests and responses. These tools allow the user to be a man-in-the-middle between the browser and the web server. These posts are going to be a bit "to-the-point," as they are intended to be give instructional guidance. This is the first post in the series, so pour yourself a nice drink, put on your favorite hacking music, and jump on in. Note: these posts reference an instance of JuiceShop that is set up on the free tier of service at Heroku. The site not maintained and it may or may not be available when you want to test it. If you happen to find that the site is down, you can set up your own JuiceShop instance in Heroku fo...

The purpose of this post is to provide information about setting up a free instance of JuiceShop in Heroku for use with a CTF. Please read the steps below carefully. NOTICE If you create a new account, you will be required to supply a valid credit card number. The Heroku service is free to use, but it is still a business that wants to make money. If you use the free tier, your card will not be charged. If you add options outside of what is spelled out in this document, you are liable for any expenses that you incur. Please don’t go past the ropes unless you know how to swim. OWASP is not responsible for any charges that you may incur from the use of the Heroku service. More information about Heroku’s free tier and pricing can be found here . NOTICE PART DEUX This event is a simple web application capture the flag. There should be no need for you to use denial of service tactics or network attack tools as part of this event. Technically, everything you need is righ...