The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Putting It All Together: Burp Intruder

The JAttack tool consists of less than 250 lines of simple code, and yet in a few

seconds, it uncovered at least three potentially serious security vulnerabilities

while fuzzing a single request to an application.

Nevertheless, despite its power, as soon as you start to use a tool like JAttack

to deliver automated bespoke attacks, you will quickly identify additional

Chapter 13 

■

Automating Bespoke Attacks

491

70779c13.qxd:WileyRed  9/14/07  3:14 PM  Page 491

---

functionality that would make it even more helpful. As it stands, you need to

configure every targeted request within the tool’s source code and then recom-

pile it. It would be better to read this information from a configuration file and

dynamically construct the attack at runtime. In fact, it would be much better to

have a nice user interface which lets you configure each of the attacks described

in a few seconds.

There are many situations in which you will need more flexibility in the way

that payloads are generated, requiring many more advanced payload sources

than the ones we have created. You will also often need support for SSL, HTTP

authentication, and automatic encoding of unusual characters within payloads.

There are situations in which modifying a single parameter at a time will be too

restrictive — you will want to inject one payload source into one parameter,

and a different source into another. It would be good to store all of the applica-

tion’s responses for easy reference, so that you can immediately inspect an

interesting response to understand what is happening, and even tinker with the

corresponding request manually and reissue it. It would also be nice to inte-

grate the tool with other useful hack tools like a proxy and a spider, avoiding

the need to cut and paste information back and forth.

Burp Intruder is a unique tool that implements all of this functionality. It is

designed specifically to enable you to perform all kinds of bespoke automated

attacks with a minimum of configuration, and to present the results in a rich

amount of detail, enabling you to quickly home in on hits and other anom-

alous test cases. It is also fully integrated with the other Burp Suite tools — for

example, you can trap a request in the proxy, pass this to Intruder to be fuzzed,

and within seconds identify the kind of vulnerabilities described in the previ-

ous example.

We will describe the basic functions and configuration of Burp Intruder and

then look at some examples of it being used to perform bespoke automated

attacks.