As part of my next round of Air Force Training's Advanced Distance Learning I had to chose a tool from a list and do a short research assignment on the tool. I chose Burp Suite. Here is what I wrote...seemed like a good idea of post something I wrote. I got 8/10 on this because it is "Accurate" and not a "Detailed Analysis of Technical Content". I did remove a few items for OPSEC purposes.

System Name:

BurpSuite

Primary Purpose:

Burp Suite is a web vulnerability scanner, web spider, and interception proxy that allows for the interception of web based traffic for the purpose of inspection, modification, and replay.

Subfunctions:

• Automated crawler and vulnerability scanner
• Real-time scanning
• Interception proxy
• Intruder and Repeater
• Cookie Jar
• Extender

Capabilities supported:

• Automated crawler and vulnerability scanner: Checks for over 100 generic vulnerabilities, has a customizable and powerful scoping mechanism to ensure scans are limited to approved applications, and a wide range of attack insertion points to test all aspects of an application.
• Real-time scanning statistics to aid manual tests of web applications including live scanning as you browse.
• Interception proxy to view and modify any we request. Modification can be manual or automated though matching algorithms and regular expressions. The proxy also supports interception of Web Sockets.
• Intruder and Repeater allow for modification of captured traffic to test web applications. Repeater supports manual manipulation of traffic while Intruder automates attacks and tests based on user supplied criteria. Processing rules allow testers to automate tasks such as encoding, iteration, and match/replace.
• Cookie Jar allows users to save and craft cookies for use on follow on tests.
• Extender implements an App Store type functionality within Burp that allows extensions to be installed that implement additional functionality. A couple such examples are SQLMapper (perform SQL injection tasks), WSDLyzer (analyze and parse WSDL files), and Burp Collaborator (checks for injectable HTTP headers). Extender also allows for custom scripting to create homegrown extensions.

Documentation:

PortSwigger Support: https://support.portswigger.net/
Burp Suite Tutorial: https://www.pentestgeek.com/web-applications/burp-suite-tutorial-1
Burp Suite Essentials: http://shop.oreilly.com/product/9781783550111.do

Equipment requirements:

• Computer running Linux or Windows
• Network connection
• Browser that supports custom proxy configurations
Connectivity requirements:
• Requires connection to the network on which the application being tested resides.

Normal locations/units:

Burp Suite is usually used by penetration testers, developers, and vulnerability analysts. The [removed] uses Burp as part of their blue team assessment mission.

Lead developer/vendor:

PortSwigger Web Security

Current fielding status:.

PortSwigger produces two versions of Burp Suite: Professional and Free. The free version does not include the vulnerability scanning feature, some advanced features, and rate limits attacks conducted with intruder.

Known problems:

• Limited support for WebSockets. Burp can intercept WebSockets but cannot replay them (Intruder or Repeater).
• No support for HTTP2
• https://support.portswigger.net/customer/portal/questions/11690301-http2-support

Point of contact:

Burp is used as part of the [removed]. The program management office for the[removed] is located at [removed] AFB as part of the [removed]. They can be contacted at [removed].

Reference:

All information was sourced from the vendor’s website – https://portswigger.net