BURPing for Developers
summary
Demo shows Burp Suite Community Edition configured as a local proxy/intercept to capture browser traffic, modify an auth response to set admin=1, and observe UI changes; uses repeater/intruder to replay requests and brute force talk IDs 1000–1500 (own talk ID 1327) to detect IDORs; uploads an SVG containing alert(1) to test XSS; uses the decoder to reveal URL-encoded fields. Community edition is slower than Pro for automated attacks but supports manual inspection, replay, mocking responses and simple fuzzing.
AI-written summary · about
chapters (12)
- 0:00Welcome
- 1:46Why learn Burp Suite
- 3:54HTTP tool poll results
- 4:57What is Burp Suite
- 7:02Demo setup
- 8:26Intercepting requests
- 13:07Repeater for payloads
- 14:10Tampering responses
- 17:29Intruder for IDOR
- 20:58Decoder for encoding
- 22:04Why developers use Burp
- 22:47Q&A
related talks
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
47mReversing Engineering a Web Application - For Fun, Behavior & WAF Detection
21mSecurity is Everyone's Responsibility
01h 04mServer-Side Browsing Considered Harmful
41mServer Side Prototype Pollution
38mStatic Analysis for Dynamic Assessments
27mReverse Engineering a Private API
22mIntegrating Security Measures Throughout Development