CHALLENGE INFORMATION
Platform: TryHackMe
Path: Complete Beginner
Module: Web Hacking Fundamentals
Room: Burp Suite: The Basics
Description: An introduction to using Burp Suite for web application pentesting.
Introduction
Question 1: Let us start!
No answer needed
What is Burp Suite
Question 1: Which edition of Burp Suite runs on a server and provides constant scanning for target web apps?
Burp Suite Enterprise
Question 2: Burp Suite is frequently used when attacking web applications and ______ applications.
Mobile
Features of Burp Community
Question 1: Which Burp Suite feature allows us to intercept requests between ourselves and the target?
Proxy
Question 2: Which Burp tool would we use to brute-force a login form?
Intruder
Installation
Question 1: If you have chosen not to use the AttackBox, ensure that you have a copy of Burp Suite installed before proceeding.
No answer needed
The Dashboard
Question 1: What menu provides information about the actions performed by Burp Suite, such as starting the proxy, and details about connections made through Burp?
Event log
Navigation
Question 1: Which tab Ctrl+Shift+P will switch us to?
Proxy tab
Options
Question 1: In which category can you find a reference to a Cookie jar?
Sessions
Question 2: In which base category can you find the Updates sub-category, which controls the Burp Suite update behaviour?
Suite
Question 3: What is the name of the sub-category which allows you to change the keybindings for shortcuts in Burp Suite?
Hotkeys
Question 4: If we have uploaded Client-Side TLS certificates, can we override these on a per-project basis (yea/nay)?
yea
Introduction to the Burp Proxy
Question 1: Click me to proceed to the next task.
No answer needed
Connecting through the Proxy (FoxyProxy)
Question 1: Click me to proceed to the next task.
No answer needed
Site Map and Issue Definitions
Question 1: What is the flag you receive after visiting the unusual endpoint?
<redacted-flag>
The Burp Suite Browser
Question 1: Click me to proceed to the next task.
No answer needed
Scoping and Targeting
Question 1: Add http://<machine-ip>/ to your scope and change the proxy settings to only intercept traffic to in-scope targets.
See the difference between the amount of traffic getting caught by the proxy before and after limiting the scope.
No answer needed
Proxying HTTPS
Question 1: If you are not using the AttackBox, configure Firefox (or your browser of choice) to accept the PortSwigger CA certificate for TLS communication through the Burp Proxy.
No answer needed
Example Attack
Question 1: Click me to proceed to the next task.
No answer needed
Conclusion
Question 1: I understand the fundamentals of using Burp Suite!
No answer needed