Burp Suite is an integrated platform for performing security testing of web applications. It has several built-in tools like Proxy, Scanner, Intruder, Repeater, and Decoder. Extensions can enhance Burp Suite's capabilities. The document discusses the Param Miner and Burpbounty extensions, which can identify hidden parameters and launch attacks on multiple requests. It also lists some other useful extensions and provides a demo lab and takeaways.

1. Burp
Suite
Overview
Author: Ajit Mahapatra
Date: 3/18/2023

2. #whoami
LinkedIn
• Working as Senior Solution Advisor in
Deloitte USI
Ajit Mahapatra

3. What is Burp Suite ?
Burp Suite Tools
Extensions: Param Miner & Burpbounty
Demo
Useful Extensions
Takeaways
Outlines

4. What is Burp Suite ?
Burp Suite is an integrated platform for performing
security testing of applications.
Developed in Java by Portswigger (founder Dafydd
Stuttard)
Seamlessly integrated with it’s inbuilt tools to support
the entire testing process
Capabilities can be enhanced by installing/creating
add-ons

5. • Dashboard
• Target
• Proxy
• Intruder
• Repeater
• Sequencer
• Decoder
• Comparer
• Extender
• Project Options
• User Options
Burp Suite Tools

6. Extensions: Param Miner & Burpbounty
This extension identifies hidden, unlinked
parameters
Guesses up to 65,536 param names per request
Also harvests additional words from all in-scope
traffic
To use it, right click on a request in Burp and click
"Guess (cookies|headers|params)"
Can launch the attack on multiple selected
requests at the same time
Param Miner
A Burp Suite extension that enhances the active and
passive scanner
Allows to add new and customize vulnerability profiles
Simulate a manual pen-test in search of maximum efficiency
without making unnecessary requests
Gathers sensitive and confidential information based on
profiles.
Burpbounty

7. Useful Extensions
• Burp Bounty Pro
• Param Miner
• ActiveScan++
• js-link-finder
• Upload Scanner
• Content-Type Converter
• HTTP Request Smuggler
• Auto repeater

8. Demo
https://portswigger.net/web-security/web-cache-
poisoning/exploiting-design-flaws/lab-web-cache-
poisoning-with-an-unkeyed-header

9. • Analyze the mentioned and popular Burp Suite extension Apps
• Use key features of Burp Suite to manage your security testing process
in an effective and efficient way.
Takeaways

10. Any Questions?
https://burpbounty.net/
https://kali.org/tools/burpsuite/
https://www.geeksforgeeks.org/what-is-burp-suite/
https://portswigger.net/blog/practical-web-cache-poisoning
References: