Приветствую! Как поставить бурп про? Есть может гайд или подобное?
-
XSS.stack #1 – первый литературный журнал от юзеров форума
0. гуглишь
1. ставиишь Java Runtime Environment (JRE),
2. запускаешь java -jar -Xmx1024m /home/путьДоБурпа/burpsuite.jar
1. ставиишь Java Runtime Environment (JRE),
2. запускаешь java -jar -Xmx1024m /home/путьДоБурпа/burpsuite.jar
Прежде чем давать ссылки на что либо, надо это самому сначала проверить. XSS не склад с говном на который можно вываливать всякое не проверяя даже как оно работает. Тут некоторые выкладывают чёрти что и отлетают потом в перманентный бан, потому что софт на который они ссылаются оказывается склеен с какой то малварью.
Что касается самого бурпа, поиск по форуму для чего сделан? /threads/64914/
есть телеграмм канал вроде связан с burp, там постоянно новые версии, а так же инструкция в архивав и для винды и для linux
https://t.me/burpsuite вроде вот он
https://t.me/burpsuite вроде вот он
есть разные версии с мануалами по установке, последняя вроде 17 февраля опубликована, поищешь
Burp is the tool I use most often for all my projects in the web app field. I've found all my best exploits/bypasses/developer mistakes and more with burp first. For anyone seriously interested in exploiting web applications or carding/fraud etc you should be utilizing burp as a starting point every time if youre serious and plan to be consistently successful. I've written some articles in places regarding my successful 6+ figure attacks on major corporations like kmart/sears etc. Here is an article I wrote for xss where I pretty much started and ended with burp threads/54108/ and even when the developers caught on to my abuse I was again able to use burp to defeat their patches twice.
Community edition is a great place to start and still quite potent and effective in the right hands. I strongly recommend the official community edition if you are just getting into burp and can assure you that as a proxy alone it provides much value when paired with a patient brain capable of critical thinking. Learning and tinkering with how things communicate with eachother will show you just how vulnerable things are on a majority of platforms out there. How easy trust is abused, or on many occasions just outright given lol.
Running automated scanners for endpoints to test sqli, xss, exposed buckets, subdomain takeovers and owasp top 10 lists is not going to be something consistently profitable and has a high chance of a million other guys already having reached that target before you. Theres a time and place for things like that or fuzzing subdirectories depending on the scenario but i see a lot of guys that spin up burp pro, load it up with all the pro plugins and shiny scanners and then they get bored, fall off never heard of again and leave having the same understanding they came in with. All that combined doesnt come close to the same value as doing something simple like watching your post/get requests everytime you login to something, or checkout somewhere, or link something, query something and seeing what kind of data is being passed and then seeing responses and editing different fields and request methods and seeing what kind of responses you get and working from there. You'll find that insecurity or dev mistakes are not rare unicorns and you can pretty much trip over them all the time. When you find things get creative with your thinking and consider different ways you can monetize what youve found if possible or perhaps link it something else you found
Community edition is a great place to start and still quite potent and effective in the right hands. I strongly recommend the official community edition if you are just getting into burp and can assure you that as a proxy alone it provides much value when paired with a patient brain capable of critical thinking. Learning and tinkering with how things communicate with eachother will show you just how vulnerable things are on a majority of platforms out there. How easy trust is abused, or on many occasions just outright given lol.
Running automated scanners for endpoints to test sqli, xss, exposed buckets, subdomain takeovers and owasp top 10 lists is not going to be something consistently profitable and has a high chance of a million other guys already having reached that target before you. Theres a time and place for things like that or fuzzing subdirectories depending on the scenario but i see a lot of guys that spin up burp pro, load it up with all the pro plugins and shiny scanners and then they get bored, fall off never heard of again and leave having the same understanding they came in with. All that combined doesnt come close to the same value as doing something simple like watching your post/get requests everytime you login to something, or checkout somewhere, or link something, query something and seeing what kind of data is being passed and then seeing responses and editing different fields and request methods and seeing what kind of responses you get and working from there. You'll find that insecurity or dev mistakes are not rare unicorns and you can pretty much trip over them all the time. When you find things get creative with your thinking and consider different ways you can monetize what youve found if possible or perhaps link it something else you found
Последнее редактирование:
take it easy
Ralf Hacker Channel
t.me
Мануал внутри