(0)

Penetration Testing of Computer Networks Using Burpsuite and Various Penetration Testing Tools

E-book


Burp Suite is an integrated platform/graphical tool for performing security testing of web applications. Burp suite is a java application that can be used to secure or crack web applications. The suite consists of different tools, like a proxy server, a web spider an intruder and a so-called repeater, with which requests can be automated. You can use Burp's automated and manual tools to obtain detailed information about your target applications.

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.

In this report I am using a combination of Burp tools to detect and exploit vulnerabilities in Damn Vulnerable Web App (DVWA) with low security. By default, Burp Scanner scans all requests and responses that pass through the proxy. Burp lists any issues that it identifies under Issue activity on the Dashboard. You can also use Burp Scanner to actively audit for vulnerabilities. Scanner sends additional requests and analyzes the application's traffic and behavior to identify issues.

Various examples are outlined in this report for different types of vulnerabilities such as: SQL injection, Cross Site Request Forgery (CSRF), Cross-site scripting, File upload, Local and Remote File Inclusion. I tested various types of penetration testing tools in order to exploit different types of vulnerabilities. The report consists from the following parts:

1. Installing and Configuring BurpSuite

2. BurpSuite Intruder.

3. Installing XMAPP and DVWA App in Windows System.

4. Installing PHP, MySQL, Apache2, Python and DVWA App in Kali Linux.

5. Scanning Kali-Linux and Windows Using .

6. Understanding Netcat, Reverse Shells and Bind Shells.

7. Adding Burps Certificate to Browser.

8. Setting up Target Scope in BurpSuite.

9. Scanning Using BurpSuite.

10. Scan results for SQL Injection Vulnerability with BurpSuite and Using SQLMAP to Exploit the SQL injection.

11. Scan Results for Operating System Command Injection Vulnerability with BurpSuite and Using Commix to Exploit the OS Command Injection.

12. Scan Results for Cross Side Scripting (XSS) Vulnerability with BurpSuite, Using Xserve to exploit XSS Injection and Stealing Web Login Session Cookies through the XSS Injection.

13. Exploiting File Upload Vulnerability.

14: Exploiting Cross Site Request Forgery (CSRF) Vulnerability.

15. Exploiting File Inclusion Vulnerability.

16. References.



  1. Penetration Testing of Computer Networks Using Burpsuite and Various Penetration Testing Tools

    Dr. Hidaia Mahmood Alassouli

    book
  2. علامات الساعة الصغرى والكبرى : The Minor and Major Signs of Judgment Day

    Dr. Hidaia Mahmood Alassouli

    book
  3. تعقيب الكاتبة على سلسله فيديوهات الدكتورة مايا صبحي حول الخيوط الخفيه للماسونية : Author's Comments on Dr. Maya Sobhi's Series of Videos about the Hidden Secrets of Freemasonry

    Dr. Hidaia Mahmood Alassouli

    book
  4. مختارات من مقالات الكاتبه حول قضايا سياسيه وإقتصاديه وإجتماعيه ومؤسساتيه ودينيه (إصدار عام 2022) : Selections from the Author's Articles on Political, Economic, Social, Institutional and Religious Issues, Issued in 2022

    Dr. Hidaia Mahmood Alassouli

    book
  5. Footprinting, Reconnaissance, Scanning and Enumeration Techniques of Computer Networks

    Dr. Hidaia Mahmood Alassouli

    book
  6. Wireless and Mobile Hacking and Sniffing Techniques

    Dr. Hidaia Mahmood Alassouli

    book
  7. Common Windows, Linux and Web Server Systems Hacking Techniques

    Dr. Hidaia Mahmood Alassouli

    book
  8. أبرز أحداث يوم القيامه في ضوء ما جاء بالقرآن الكريم والسنه النبوية الشريفة : The Most Prominent Events on the Day of Judgment and the Resurrection Based on Quran and Sunnah

    Dr. Hidaia Mahmood Alassouli

    book
  9. Calculation of Critical Distance in Faulted Meshed Power System

    Dr. Hidaia Mahmood Alassouli

    book
  10. Comparison between Internet Fax Services

    Dr. Hidaia Mahmood Alassouli

    book
  11. Fuse Protection against the Regenerative Circuit Internal Commutation Fault

    Dr. Hidaia Mahmood Alassouli

    book
  12. Introduction to Power System Protection

    Dr. Hidaia Mahmood Alassouli

    book