Lecciones Prácticas

Currently I am attending a workshop on Designing Secure Wep Apps and there I learned about Burp suite and Foxy proxy (standard).

What is Burp Suite?

Burp Suite is an integrated platform for attacking web applications. It contains all of the Burp tools with numerous interfaces between them designed to facilitate and speed up the process of attacking an application. All tools share the same robust framework for handling HTTP requests, persistence, authentication, upstream proxies, logging, alerting and extensibility.

Burp Suite allows you to combine manual and automated techniques to enumerate, analyse, scan, attack and exploit web applications. The various Burp tools work together effectively to share information and allow findings identified within one tool to form the basis of an attack using another.

Key features unique to Burp Suite include:

* Detailed analysis and rendering of requests and responses.
* One-click transfer of interesting requests between tools.
* Site map showing information accumulated about target applications in tree and table form.
* Ability to “passively” spider an application in a non-intrusive manner, with all requests originating from the user’s browser.
* Suite-level target scope configuration, driving numerous individual tool actions.
* Fully fledged web vulnerability scanner. [Pro version only]
* Ability to save and restore state. [Pro version only]
* FIPS-compliant statistical analysis of session token randomness.
* Utilities for decoding and comparing application data.
* A range of engagement tools, to make your work faster and more effective. [Pro version only]
* Suite-wide search function. [Pro version only]
* Support for custom client and server SSL certificates.
* Extensibility via the IBurpExtender interface.
* Centrally configured settings for upstream proxies, web and proxy authentication, and logging.
* Tools can run in a single tabbed window, or be detached in individual windows.
* Runs in both Linux and Windows.

What is Foxy Proxy?

FoxyProxy is a set of proxy management tools for Firefox, Thunderbird, Seamonkey, and Songbird. There are three editions available (basic, standard, plus). Both basic and standard are free. I use standard.

More coming next days!

Related posts:

1. mod_rewrite: RewriteCond, RewriteRule, QUERY_STRING, REQUEST_URI [GUIA RÁPIDA]