A Complete Guide to Burp Suite

Use this comprehensive guide to learn the practical aspects of Burp Suite―from the basics to more advanced topics. The book goes beyond the standard OWASP Top 10 and also covers security testing of APIs and mobile apps.

Burp Suite is a simple, yet powerful, tool used for application security testing. It is widely used for manual application security testing of web applications plus APIs and mobile apps. The book starts with the basics and shows you how to set up a testing environment. It covers basic building blocks and takes you on an in-depth tour of its various components such as intruder, repeater, decoder, comparer, and sequencer. It also takes you through other useful features such as infiltrator, collaborator, scanner, and extender. And it teaches you how to use Burp Suite for API and mobile app security testing.

You will:

• Understand various components of Burp Suite
• Configure the tool for the most efficient use
• Exploit real-world web vulnerabilities using Burp Suite
• Extend the tool with useful add-ons

Table of Contents

Chapter 1: Introduct ion to Burp Suite

Chapter 2: Setting Up the Environment

Chapter 3: Proxy, User Options, and Proj ect Options

Chapter 4: Dashboard, Target, and Engagement Tools

Chapter 5: Intruder

Chapter 6: Repeater, Comparer, Decoder, and Sequencer

Chapter 7: Infiltrator, Collaborator, Clickbandit, and CSRF PoC Generator

Chapter 8: Scanner and Reporting

Chapter 9: Extending Burp Suite

Chapter 10: Testing Mobile Apps and APls with Burp Suite

About the Author

Sagar Rahalkar is a seasoned information security professional with more than 13 years of experience in various verticals of information security. His domain expertise is mainly in AppsSec, cyber crime investigations, vulnerability assessments, penetration testing, and IT GRC. He holds a master’s degree in computer science and several industry-recognized certifications such as CISM, ISO 27001LA, and ECSA. He has been closely associated with Indian law enforcement agencies for more than three years, dealing with digital crime investigations and related training, and received awards from senior officials of the police and defense organizations in India. He also is an author and reviewer for several publications.