5 Most Useful Burp Extensions for Penetration Testing
https://hacksheets.in/2021/06/04/5-most-useful-burp-extensions-for-penetration-testing/
These burp suite extensions will help you save lot of your time testing the target and provides you a wide testing coverage.
- Autorize
Wondering how to check authorization and access control issues in large web applications in minutes. This extension helps the pentesters detect vertical and horizontal authorization issues and unauthenticated access issues in applications quickly.
The extension takes cookies of low privileged user and it checks the authorization and access issues when the tester navigates the application as a high privileged user. It also checks if pages are accessible without session Identifiers.
The results are shown in three colors to identify issues:
- Bypassed! — Red color
- Enforced! — Green color
- Is enforced??? (please configure enforcement detector) — Yellow color
Source Code: https://github.com/portswigger/autorize
2. Logger++
The in-built burp history tool captures all the traffic that Burp intercepts from Browser. However, if you want to see logs for Burp scanner or different extensions, Logger++ will come to rescue.
It stores all Burp’s requests and responses in an easily exported and sortable table.
3. Upload Scanner
File uploads are used in lots of web applications. Testing this functionality require lots of file types and content to make sure the application only accepts what is required. Upload Scanner saves lot of time while performing these tests. It has the ability to upload a number of different file types, laced with different forms of payload. Upload Scanner can test for vulnerabilities including server-side request forgery (SSRF) and XML external entity (XXE) injection using common file types like JPEG, PDF, and MP4 as vectors.
4. Turbo Intruder
Burp in-built Intruder is powerful bruteforcing tool, however, Turbo Intruder is much more faster and uses a custom HTTP stack. It is configured in Python and capable of making tens of thousands of HTTP requests per second.
It is great for detecting issues such as race conditions and performing complex test cases.
5. JSON Web Tokens
JSON Web Tokens aka JWT are widely used for authorization now a days in many web applications. Decoding and testing them for security is lengthy since you need to copy the token and paste it in a tool somewhere that can decode base64 and provide you an understanding on different JWT sections. JSON Web Tokens extension provides you ability to decode and understand JWT tokens in a snap. It also has editor and provides resigning and signature checks for JWT. It flags requests automatically that contains JWTs. This is a must have tool for pentesters hunting JWT issues.
Originally published at https://hacksheets.in on June 4, 2021.
