This is a training for Web hackers who want to master their toolbox. Burp Suite Pro is the leading tool for auditing Web applications at large, but also a complex beast where new features get added every few weeks. Mastering Burp Suite Pro, including its newest features, allows testers to get the most out of the tool, optimizing time spent auditing and testing. Work will be faster (hotkeys!) and much more efficient (more tools, more possibilities!). Attendees will also learn to measure and assess the quality of their attacks, a crucial skill in real-life engagements that can make the difference between a false-negative and a critical finding.
Menial tasks (like sharing requests among the different tools, applying common encodings or navigating the GUI) should be as fast and transparent as possible, in order to free time and brain power for harder subjects.
Recurrent tasks (like brute-forcing a CSRF-protected form, frobbing an opaque blob of data, logging-in automatically or doing 1-byte fuzzing of a specific parameter) should be executed without having to think too much about it, thanks to prior rehearsals.
Advanced tasks (like managing a complex state, dealing with a custom format or testing authorizations) should be doable exclusively in Burp Suite Pro, possibly with the help of session handling rules or specific extensions. These tasks require testers to live-assess themselves, in order to detect as early as possible any error and to allow for correction and self-improvement.
Nicolas Grégoire has been auditing web apps for 20 years. He is an official Burp Suite Pro trainer since 2015, and has trained more than a thousand people since then, either privately or at public events. Other of that, he runs Agarri, a one-man business where he looks for security vulnerabilities for clients and for fun. His public talks (covering SSRF, XSLT, Burp Suite, ...) have been presented at numerous conferences around the world.
Four days of hands-on practice!
After an introduction to the training platform and its challenges, the day is spent on well defined tasks where the goal is to find flags, like in CTF contests. We practice basic automation using
tools like Proxy, Repeater and Intruder. The goal is to improve the speed of our interactions with the tool, while monitoring and self-assessing our attacks.
The second day is dedicated to macros and session handling rules, first on Web applications then on APIs (both SOAP Web services and REST endpoints). Additionally, we keep working on the efficiency of the testing workflow (using shortcuts or extensions) and on self-monitoring (with the built-in Logger tool or with the Logger++ extension). The latter skill will later prove itself invaluable when debugging advanced automation scenarios.
On the third day, we exclusively cover extensions. A large share of that time is dedicated to “meta extensions”. This term describes extensions which at the same time cover recurrent needs (display, transform, export, …) and can easily be adapted to specific situations. We also cover more specific extensions, including the ones enabling headless usage of Burp Suite Pro.
The fourth day includes two distinct sections. The first one dives deep in the often overlooked built-in tools that are Audit and Crawl, Collaborator and Infiltrator. The second section deals with the often cumbersome and boring task of identifying authorization-based vulnerabilities, as we detail how different extensions can ease this process.
RomHack is made with 🤍 by Cyber Saiyan
Support us making a donation or becoming a member
[ Code of Conduct ]
Cyber Saiyan Ente del Terzo Settore – C.F. (FC) 97958200582 – VAT 14669161003
