A Vision of Web Application Security  2

Configuration for a Local Web Server

  An schema where the Web Server is installed in the Local Machine require an a browser like Firefox that premit configure his proxy to point the BurpSuite proxy, use the FoxyProxy Extension in order to enable the flow to the local proxy address, in this case 127.0.0.1

The extension is added and then configured to 127.0.0.1:8080

Now we can run a web server in a Docker Container on Local Machine no test the proxy to de local server.

Test a Request to the local server, in this case http://127.0.0.1:5000

The page will wait for the response, so click on Forward till all the requests are sended. And check the history. It will come with other automatic request the firefox browser do.

To clean the output, just put a Filter on the address of interest and repeat the interception

The Result with filter

EOT

 A Vision of Web Application Security  1

To undersand the vulnerabilities of a Web Application, we need to think like an attacker do. In order to reach this, we will use a suite that works on webs applications that generates variants of the requests to simulate a normal traffic, and this suite is the burpsuite that works like a man in the middle in order to alter of modify the normal behaviour. it use a proxy configuration. The proxy configuration could be for a external server or a local server. for the local server configuration requires an extra configuration.

Normal Configuration before configure proxy

Step 1: Download and install Burpsuite

 

Once installed burpsuite, we use the proxy tab.

click on intercept on will show request that the system do to servers, some of them are automatic for telemetry and so on, and also request of our actions.

Step 2: configure the proxy setting to 127.0.0.1:8080

   Schema of Client, BurpSuite as Proxy and external Web Server

Step 3: Configure the proxy of the Firefox browser (App Proxy) and the CA Certificate

When open any website the browser responds with error

when Open any website respond with error...

Now go to http://burp to download cd CA Certificate

Go to the Administartion of certificates of the Firefox settings and add it.

 

From Now any web page can be opened in Firefox browser.

Step 4: On Tab Proxy click on intercept On , Do a Request to an external Site https://portswigger.net Click Open Browser, it will open the chrome browser,

...

...
Step 5: Now the intercept is active, the server is waiting for the request that is in brupsite proxy, to send to the server, press Forward or Forward All till all the frames finish to arrive to the server.

...
Step 6: Once finish the transaction, the history of traces are on Tab Proxy --> Tab Http History