I have received many questions on how to properly handle authentication when using BurpCSJ, so here is a short tutorial on how to properly manage authentication. If you are looking for how to use this Burp extension, here is a basic tutorial as well.
In this post, we are going to use BurpCSJ against the Altoro bank (vulnerable web application made on purpose), which is available online here: http://demo.testfire.net/
First, start clean (the reasons will be clear at the end of this tutorial):
- Start Burp;
- Start browser and configure proxy settings to work with Burp;
- Browse to target site: http://demo.testfire.net/
- Perform login: user: jsmith - password: Demo1234
- Check Burp cookie jar (under options/sessions), this should be populated with some cookies:
- Configure BurpCSJ (Crawljax tab) and make sure that "Use Manual Proxy" is ticked and it is pointing to Burp and that the "Use cookie jar" option is ticked as well:
- Start/Launch BurpCSJ against target site (right-click, Send URL to crawljax option). When BurpCSJ launches Crawljax, you will notice that the first request has no "cookie" - this is normal in WebDriver and the reason why this occurs is that WebDriver needs to first initialize, so no worries.
- the second request, or third request (depending if there is a redirection) and all the subsequent requests performed by Crawljax will include the valid cookies from the cookie jar.
You are now performing an authenticated crawling session and if you check the browser managed by WebDriver, you should notice that it is using a valid authenticated session.
In case you do not follow the first two steps, you might end up having some issues and failing to run a proper authenticated crawling session. This happened to me quite few times...
Let's say that you already started the browser, logged in and then you enable proxy with Burp and then you run BurpCSJ. The issue is that Burp does not have history of the Set-Cookie directive so it will identify the cookies sent by the browser and will populate the Cookie jar by taking as a reference the parent domain only.
Below, you can see the issue by comparing the cookies in the browser and the ones in the Burp cookie jar. Can you spot the difference? ;-)
If this happens, a BurpCSJ crawling against demo.testfire.net would not use the cookies in the Burp cookie jar, as demo.testfire.net doesn't match with testfire.net. So no authenticated crawling session in this case...
So don't be lazy, if you have to restart/clean the browser time to time... ;-)
The latest Crawljax package has fixed multiple issues. I have noticed the crawler is more diligent and sticks to the target domain instead of visiting other pages from out-of-scope domains.
As usual, feedback is more than welcome and feel to contact me or raise github issues - https://github.com/malerisch/burpcsj
In this post, we are going to use BurpCSJ against the Altoro bank (vulnerable web application made on purpose), which is available online here: http://demo.testfire.net/
First, start clean (the reasons will be clear at the end of this tutorial):
- Start Burp;
- Start browser and configure proxy settings to work with Burp;
- Browse to target site: http://demo.testfire.net/
- Perform login: user: jsmith - password: Demo1234
- Check Burp cookie jar (under options/sessions), this should be populated with some cookies:
- Configure BurpCSJ (Crawljax tab) and make sure that "Use Manual Proxy" is ticked and it is pointing to Burp and that the "Use cookie jar" option is ticked as well:
- Start/Launch BurpCSJ against target site (right-click, Send URL to crawljax option). When BurpCSJ launches Crawljax, you will notice that the first request has no "cookie" - this is normal in WebDriver and the reason why this occurs is that WebDriver needs to first initialize, so no worries.
- the second request, or third request (depending if there is a redirection) and all the subsequent requests performed by Crawljax will include the valid cookies from the cookie jar.
You are now performing an authenticated crawling session and if you check the browser managed by WebDriver, you should notice that it is using a valid authenticated session.
In case you do not follow the first two steps, you might end up having some issues and failing to run a proper authenticated crawling session. This happened to me quite few times...
Let's say that you already started the browser, logged in and then you enable proxy with Burp and then you run BurpCSJ. The issue is that Burp does not have history of the Set-Cookie directive so it will identify the cookies sent by the browser and will populate the Cookie jar by taking as a reference the parent domain only.
Below, you can see the issue by comparing the cookies in the browser and the ones in the Burp cookie jar. Can you spot the difference? ;-)
If this happens, a BurpCSJ crawling against demo.testfire.net would not use the cookies in the Burp cookie jar, as demo.testfire.net doesn't match with testfire.net. So no authenticated crawling session in this case...
So don't be lazy, if you have to restart/clean the browser time to time... ;-)
The latest Crawljax package has fixed multiple issues. I have noticed the crawler is more diligent and sticks to the target domain instead of visiting other pages from out-of-scope domains.
As usual, feedback is more than welcome and feel to contact me or raise github issues - https://github.com/malerisch/burpcsj
How would one use BurpCSJ handle an application which prompts the user for an id and password but does not create a session id cookie? Instead it sets an internal JavaScript variable and passes that with every request - as a hidden POST variable in most cases.
ReplyDeleteBurpCSJ through proxy and then in Proxy options, you need to have a Match/Replace entry to have Burp automatically add the hidden POST variable to each HTTP request. See here: http://portswigger.net/Burp/help/proxy_options.html . Hope it helps.
ReplyDeleteThank you for the article.
ReplyDelete