Burp

How to intercept local server web requests using Burp in Internet Explorer

由 限于喜欢 提交于 2019-12-06 13:14:32
问题 I have properly configured Burp to intercept at a proxy location at 127.0.0.1:9090 My Internet Explorer proxy settings are as follows: Also I have a webserver named WebGoat running in http://localhost:8080/WebGoat/ All the requests are not being intercepted by Burp, in any way. What Should I do? 回答1: Try adding a '.' after "localhost". This should solve your problem. eg. http://localhost.:8080/WebGoat/ This will force the localhost to use the same proxy settings as one would with an internet

How to intercept local server web requests using Burp in Internet Explorer

由 和自甴很熟 提交于 2019-12-04 18:56:10
I have properly configured Burp to intercept at a proxy location at 127.0.0.1:9090 My Internet Explorer proxy settings are as follows: Also I have a webserver named WebGoat running in http://localhost:8080/WebGoat/ All the requests are not being intercepted by Burp, in any way. What Should I do? Try adding a '.' after "localhost". This should solve your problem. eg. http://localhost.:8080/WebGoat/ This will force the localhost to use the same proxy settings as one would with an internet connection/adapter. Using IE9 and above version: Internet Options -> Connections Tab LAN settings Under

Add SSL certificate exception while proxy session via jmeter/burpsuite for an Android/iOS App

由 泪湿孤枕 提交于 2019-12-04 07:00:52
问题 I'm trying to record a session via Jmeter/Burpsuite for and Android or iOS App which interact with an HTTPS API requests e.g. https//api.server.com/login We can add the exception of SSL if using a Browser, But how can we do so while doing proxy on App for Android/iOS. 回答1: The easy way is sending the certificate to yourself by email, opening the email on the mobile device and installing the certificate using system dialog. The certificate file is ApacheJMeterTemporaryRootCA.crt and it's being

Burp Extension: add header to response

由 巧了我就是萌 提交于 2019-12-04 05:56:43
问题 Burp newbie writing an extension... I am trying to add a header to the response to test CSP rules. I have found lots of resources to add headers to Requests, but not for Responses. Here is the (non-working) code I have so far: def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo): # determine what tool we would like to pass though our extension: if toolFlag == 4: #if tool is Proxy Tab # determine if request or response: if not messageIsRequest:#only handle responses response =

Burp Suite: Page keeps on loading after proxy is configured on Firefox to record activities

由 久未见 提交于 2019-12-02 17:57:34
问题 When I set proxy to record activities in Burp Suite, URL keeps on loading, though manually without proxy it works. Its only while recording with Proxy, URL keeps on loading. Any idea why URL does not work while recording with Proxy? 回答1: You need to add a certificate for Burp proxy to your browser. The easiest way to get the certificate is to point your browser at the proxy and go to http://burp the hit the 'CA Certificate' button in the top right side of the window. Once downloaded follow

Burp Extension: add header to response

由 谁说我不能喝 提交于 2019-12-02 12:33:40
Burp newbie writing an extension... I am trying to add a header to the response to test CSP rules. I have found lots of resources to add headers to Requests, but not for Responses. Here is the (non-working) code I have so far: def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo): # determine what tool we would like to pass though our extension: if toolFlag == 4: #if tool is Proxy Tab # determine if request or response: if not messageIsRequest:#only handle responses response = messageInfo.getResponse() #get Response from IHttpRequestResponse instance responseStr = self.

Burp Suite: Page keeps on loading after proxy is configured on Firefox to record activities

由 旧城冷巷雨未停 提交于 2019-12-02 08:12:30
When I set proxy to record activities in Burp Suite, URL keeps on loading, though manually without proxy it works. Its only while recording with Proxy, URL keeps on loading. Any idea why URL does not work while recording with Proxy? You need to add a certificate for Burp proxy to your browser. The easiest way to get the certificate is to point your browser at the proxy and go to http://burp the hit the 'CA Certificate' button in the top right side of the window. Once downloaded follow these instructions https://support.portswigger.net/customer/portal/articles/1783075-installing-burp-s-ca

2019测试指南-web应用程序安全测试（二）查看Web服务器图元文件的信息泄漏

由 让人想犯罪 __ 提交于 2019-11-29 11:01:51
本节介绍如何测试robots.txt文件以查找Web应用程序目录或文件夹路径的信息泄漏。此外，Spiders，Robots或Crawler要避免的目录列表也可以创建为 应用程序的Map执行路径 的依赖项 （OTG-INFO-007） 测试目标 1. Web应用程序的目录或文件夹路径的信息泄漏。 2.创建Spiders，Robots或Crawlers要避免的目录列表。 如何测试 的robots.txt Web Spider，Robots或Crawlers检索网页，然后递归遍历超链接以检索更多Web内容。他们接受的行为由web根目录[1]中robots.txt文件的 机器人排除协议 指定。 例如，2013年8月11日 http://www.google.com/robots.txt中 抽取的robots.txt文件的开头引用如下： 用户代理： * 禁止：/搜索 禁止：/ sdch 禁止：/ groups 禁止：/ images 禁止：/目录 ... 该 用户代理 的指令是指特定的网络蜘蛛/机器人/爬虫。例如， User-Agent：Googlebot 是指来自Google的蜘蛛，而“User-Agent：bingbot” [1] 是指来自Microsoft / Yahoo!的爬虫。 上述示例中的 User-Agent：* 适用于以下引用的所有网络蜘蛛/机器人/抓取工具[2]： 用户代理
订阅 Burp