the-web-application-hackers-handbook

Chapter 14 n Automating Customized Attacks 591
better to have a nice user interface that lets you configure each of the attacks
described in a few seconds.
There are many situations in which you need more flexibility in how payloads
are generated, requiring many more advanced payload sources than the ones
we have created. You will also often need support for SSL, HTTP authentication,
multithreaded requests, automatic following of redirections, and automatic
encoding of unusual characters within payloads. There are situations in which
modifying a single parameter at a time would be too restrictive. You will want
to inject one payload source into one parameter and a different source into
another. It would be good to store all the application’s responses for easy reference
so that you can immediately inspect an interesting response to understand
what is happening, and even tinker with the corresponding request manually
and reissue it. As well as modifying and issuing a single request repeatedly, in
some situations you need to handle multistage processes, application sessions,
and per-request tokens. It would also be nice to integrate the tool with other
useful tools such as a proxy and a spider, avoiding the need to cut and paste
information back and forth.
Burp Intruder is a unique tool that implements all this functionality. It is
designed specifically to enable you to perform all kinds of customized automated
attacks with a minimum of configuration and to present the results
in a rich amount of detail, enabling you to quickly hone in on hits and other
anomalous test cases. It is also fully integrated with the other Burp Suite
tools. For example, you can trap a request in the proxy, pass this to Intruder
to be fuzzed, and pass interesting results to Repeater to confirm and exploit
all kinds of vulnerabilities.
We will describe the basic functions and configuration of Burp Intruder and
then look at some examples of its use in performing customized automated
attacks.
Positioning Payloads
Burp Intruder uses a conceptual model similar to the one JAttack uses, based
on positioning payloads at specific points within a request, and one or more
payload sources. However, Intruder is not restricted to inserting payload strings
into the values of the actual request parameters. Payloads can be positioned at
a subpart of a parameter’s value, or at a parameter’s name, or indeed anywhere
at all within a request’s headers or body.
Having identified a particular request to use as the basis for the attack, each
payload position is defined using a pair of markers to indicate the start and end
of the payload’s insertion point, as shown in Figure 14-1.