Due to the subject matter being relatively technical, I’m making some assumptions that you will be at least familiar with the concepts behind conducting penetration testing and vulnerability analysis. Welcome to our 3-part blog series where we will take a dive into the technical aspects of conducting exhaustive penetration tests against REST API services, generating reports based on what tests were performed, and what our findings are. Enter the Apache Struts version number that you discovered in the response (2 2.3.31).Ĭongratulations, that's another lab under your belt! You've used Burp Repeater to audit part of a website and successfully discovered an information disclosure vulnerability.Pen Testing REST API with Burp Suite Introduction: Go back to the lab in Burp's browser and click the Submit solution button. ![]() In a real scenario, this kind of information could be useful to an attacker, especially if the named version is known to contain additional vulnerabilities. Notice that the response tells you that the website is using the Apache Struts framework - it even reveals which version. The server has sent a verbose error response containing a stack trace. Observe that sending a non-integer productId has caused an exception. Send another request where the productId is a string of characters. Let's see what happens if we send a different data type. The server seemingly expects to receive an integer value via this productId parameter. Now we know how this page is supposed to work, we can use Burp Repeater to see how it responds to unexpected input. This is useful for returning to previous requests that you've sent in order to investigate a particular input further.Ĭompare the content of the responses, notice that you can successfully request different product pages by entering their ID, but receive a Not Found response if the server was unable to find a product with the given ID. The drop-down menu next to each arrow also lets you jump Use the arrows to step back and forth through the history of requests that you've sent, along with their matching responses. Try this with a few arbitrary numbers, including a couple of larger ones. Step 1: Resend the request with different inputĬhange the number in the productId parameter and resend the request. Will perform during manual testing with Burp Suite. Testing different input with Burp Repeaterīy resending the same request with different input each time, you can identify and confirm a variety of input-based vulnerabilities. You can resend this request as many times as you like and the response will be updated each time. Step 5: Send the request and view the responseĬlick Send and view the response from the server. Go to the Repeater tab to see that your request is waiting for you in its own numbered tab. Right-click on any of the GET /product?productId= requests and select Send to Repeater. Step 4: Send the request to Burp Repeater Let's use Burp Repeater to look at this behavior more closely. Notice that each time you accessed a product page, the browser sent a GET /product request with a productId query parameter. In the previous tutorial, you browsed a fake shopping website. In this example, we'll send a request from the HTTP history in Burp Proxy. The most common way of using Burp Repeater is to send it a request from another of Burp's tools. If you haven't completed our previous tutorial on setting the target scope, you'll need to do so before continuing. If you don't have one already, registration is free and it grants you full access to the Web Security Academy. To follow along, you'll need an account on. ![]() Managing application logins using the configuration library.Spoofing your IP address using Burp Proxy match and replace.Testing for reflected XSS using Burp Repeater.Viewing requests sent by Burp extensions using Logger.Resending individual requests with Burp Repeater.Augmenting manual testing using Burp Scanner.Intercepting HTTP requests and responses.Viewing requests sent by Burp extensions.Testing for SQL injection vulnerabilities.Testing for parameter-based access control.Identifying which parts of a token impact the response.Search Professional and Community Edition
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |