Burp suite

Abstract: Current needs and developments encourage the increasing use of digital-based applications. One of them is a web-based application that is easy to access and used by today’s society. Along with these developments, it is common for vulnerabilities to exist in web applications that the owners are unaware of. It creates the risk of data leakage or damage to the organization’s reputation as the application owner. In addition, the number of web applications owned by an organization or company leads to challenges in finding vulnerabilities in these applications. This happened due to time and resource constraints for conducting manual assessments. Therefore, there is necessary to use a web application vulnerability scanner, which performs vulnerability scanning automatically, to be able to help and streamline the search for vulnerabilities. There are many types of web application vulnerability scanners that can be used for free or commercially. This study evaluated the capabilities of WAVS (Web Application Vulnerability Scanners) tools such as OWASP ZAP, Wapiti, Arachni, and Burp Suite Professional with NodeJS-based benchmark targets, namely Damn Vulnerable NodeJS Application (DVNA) and NodeGoat. This study found that the four WAVS have an average f-measured value between 0.4-0.6. Burp Suite Professional had the best True Positive (TP) and Recall values, while Arachni for perfect Precision valued for both benchmark targets.

Abstract: Learn to set up, defend, and attack computer networks. This book focuses on networks and real attacks, offers extensive coverage of offensive and defensive techniques, and is supported by a rich collection of exercises and resources. You'll learn how to configure your network from the ground up, starting by setting up your virtual test environment with basics like DNS and active directory, through common network services, and ending with complex web applications involving web servers and backend databases. Key defensive techniques are integrated throughout the exposition. You will develop situational awareness of your network and will build a complete defensive infrastructureincluding log servers, network firewalls, web application firewalls, and intrusion detection systems. Of course, you cannot truly understand how to defend a network if you do not know how to attack it, so you will attack your test systems in a variety of ways beginning with elementary attacks against browsers through privilege escalation to a domain administrator, or attacks against simple network servers through the compromise of a defended e-commerce site. The author, who has coached his universitys cyber defense team three times to the finals of the National Collegiate Cyber Defense Competition, provides a practical, hands-on approach to cyber security. What youll learn How to securely set up a complete network, from its infrastructure through web applications How to integrate defensive technologies such as firewalls and intrusion detection systems into your network How to attack your network with tools like Kali Linux, Metasploit, and Burp Suite How to gain situational awareness on your network to detect and prevent such attacks Who this book is for This book is for beginning and intermediate professionals in cyber security who want to learn more about building, defending, and attacking computer networks. It is also suitable for use as a textbook and supplementary text for hands-on courses in cyber operations at the undergraduate and graduate level.

Abstract: JavaScript Object Notation (JSON) has evolved to the de-facto standard file format in the web used for application configuration, cross- and same-origin data exchange, as well as in Single Sign-On (SSO) protocols such as OpenID Connect. To protect integrity, authenticity, and confidentiality of sensitive data, JavaScript Object Signing and Encryption (JOSE) was created to apply cryptographic mechanisms directly in JSON messages.We investigate the security of JOSE and present different applicable attacks on several popular libraries. We introduce JOSEPH (JavaScript Object Signing and Encryption Pentesting Helper) -- our newly developed Burp Suite extension, which automatically performs security analysis on targeted applications. JOSEPH's automatic vulnerability detection ranges from executing simple signature exclusion or signature faking techniques, which neglect JSON message integrity, up to highly complex cryptographic Bleichenbacher attacks, breaking the confidentiality of encrypted JSON messages. We found severe vulnerabilities in six popular JOSE libraries. We responsibly disclosed all weaknesses to the developers and helped them to provide fixes.

Abstract: The invention discloses a privacy leaking detecting method and system for android application network communication. The method comprises the following steps: crawling android application to be detected, and building an application set to be detected; building a main-in-the-middle attack server; initializing each tester environment; arranging a multi-tester distributive running scheduling system; analyzing APK files of the application to be detected; installing the application program corresponding to the APK file, and driving the application program to run; analyzing a log file created by the Burp Suite, and acquiring the application set with SSL man-in-the-middle attack; analyzing a network data pack file created in the running process of the collected application program; recognizing the privacy leaking type of the network data pack file according to the application set with the SSL man-in-the-middle attack. The method is flexible to use, and automatic in the whole process; the android system and the android application program structure are not modified; the privacy leaking behavior of the android application in the network communication process can be safely and accurately detected.