We're going to mess around with a tool called
Burpsuite.
Now,
burpsuite
for CYS A purposes is limited to web application scanning. Now,
burp
Burpsuite
entire
can do penetration testing. I've used it before for SQL injections.
I've used it for a lot of different aspects, especially on the free version.
But
however,
and I press
this by saying that CYS A only identifies it for web application scanning,
which is a little bit weird
that they have this tool in here.
And the reason I say that is because usually Comptia
for their certifications is very much like we want free versions tools.
We don't want anything that costs money,
but the web application portion or
the web application scanner portion of Burpsuite
is essentially locked behind a paywall.
So I'm not really sure what Comptia
was thinking when they threw this in here, but it's OK, we're gonna go
very high level overview of it.
Just realize that we're not going to show the paid version because I
don't want to show you something that you don't really have access to
without actually paying for it.
And I don't think
Comptia
is going to provide us with anything that you really
wouldn't be able to understand based off the other tools.
So let's get right into it. We're going to open up our terminal.
Uh Let me blow this up for you. And there's literally three ways to access this tool.
I think I've only been showing you the one way.
So today we're going to actually go through all three ways.
I could type in burpsuite
just like that.
And by providing that blue over there, I can start it up just like that.
That's one way.
The second way is I can open up a little Cali Linux icon right there
and I could go down to web applications analysis and there it is right there.
The third way is I can go to the search menu and just type in burp and there it is.
So we're gonna open this sucker up. Obviously, I'm using a community edition
im gonna press next for temporary and I am going to use Burkes suite defaults
and we're gonna get the sucker started up.
Now, the very first screen that you should see
looks something like this and it says getting started with Burpsuite.
You can go through Burpsuite and it provides
a quick tutorial of how to use Burpsuite.
You could also do guided tours, provides you all the the in depth,
walkthrough of everything I want.
I don't want to say in depth, but it provides you a walkthrough of the tool
you could do video tutorials over specific features of the tool.
But again, many of them are stuck behind a paywall.
You can do a web security academy which goes
into finding out more about vulnerabilities using Burpsuite.
You could do the support center or you can use Twitter
under the dashboard.
This is normally where you would go through
and actually do a new web vulnerability scan.
But you can see here that it's grayed out because it's locked behind a paywall.
So really don't have that feature. But again, it's, it's
pretty much a web application scanner.
You're really not going to get much more out of it
than you would with any of the other
web application scanners that we've shown you IE nic
or ZAP. I really like Zap.
Um
And I don't think Burpsuite,
it does a good job, but I prefer Zap honestly.
So I'm not really upset about it being locked behind a paywall.
Some people would argue and they say Burpsuite's better.
Yeah, flavors for different folks, I guess
uh under your target icon,
you can get a sitemap, you can identify the target.
So you can go through that process,
through epoxy, you can turn the intercept on and off.
And again, this is much more utilized in web application penetration testing
than it is anything else
we can do the intruder which provides us automated tasks if we want to go through that
repeater, which modifies the recent individual requests,
so we can repeat commands.
The collaborator sounds just like it is
the sequencer which provides um requests and other tools to figure live captures.
Uh We could do a decoder sounds like exactly what it does.
We can do a compare exam exactly like it sounds
logger
exactly like it sounds. And then finally the organizer,
uh I forgot extensions. So you can actually add extensions into burpsuite
that third parties have utilized
throughout that. Now, Burpsuite
is pretty extensive tool and I could spend
an entire day going through everything that burpsuite
has to offer.
But the good news is as far as cys A exam is concerned,
we only are concerned with that live scan
or excuse me that that web application scan.
And I feel like if you see burpsuite
scan on there, you'll be able to identify it pretty quickly.
Again, it's not available in a free version. So
I can't really go through this
through the community edition.
If you really want to, you could pay for the paid version.
I don't suggest it as a brand new cybersecurity person
or even an intermediate. If you're going to get in a penetration testing,
then I would suggest. Yeah, burp
suite is a great tool for pen testing.
But for web application scanning for a defensive tool,
it's not anywhere close to my top 10
for pen testing. It definitely is but not for defensive.
And that's what cys A really concentrates on.
So the high level overview of Burpsuite.
We really didn't do much with the tool, but I hope you learned something from it.
And again, if you want more details,
just go to that learn and you can find all kinds of valuable information right here.
All right. That's it for today. We'll see you next time.