the-web-application-hackers-handbook

758 Chapter 20 n A Web Application Hacker’s Toolkit
The precise method for installing the CA certificate depends on the browser
and platform. Essentially it involves the following steps:
1. Visit any HTTPS URL with your browser via the proxy.
2. In the resulting browser warning, explore the certificate chain, and select
the root certificate in the tree (called PortSwigger CA).
3. Import this certificate into your browser as a trusted root or certificate
authority. Depending on your browser, you may need to first export the
certificate and then import it in a separate operation.
Detailed instructions for installing Burp’s CA certificate on different browsers
are contained in the online Burp Suite documentation at the following URL:
http://portswigger.net/burp/help/servercerts.html
Common Features of Intercepting Proxies
In addition to their core function of allowing interception and modification of
requests and responses, intercepting proxies typically contain a wealth of other
features to help you attack web applications:
n Fine-grained interception rules, allowing messages to be intercepted for
review or silently forwarded, based on criteria such as the target host,
URL, method, resource type, response code, or appearance of specific
expressions (see Figure 20-5). In a typical application, the vast majority of
requests and responses are of little interest to you. This function allows you
to configure the proxy to flag only the messages that you are interested in.
n A detailed history of all requests and responses, allowing previous messages
to be reviewed and passed to other tools in the suite for further analysis
(see Figure 20-6). You can filter and search the proxy history to quickly find
specific items, and you can annotate interesting items for future reference.
n Automated match-and-replace rules for dynamically modifying the contents
of requests and responses. This function can be useful in numerous
situations. Examples include rewriting the value of a cookie or other
parameter in all requests, removing cache directives, and simulating a
specific browser with the User-Agent header.
n Access to proxy functionality directly from within the browser, in addition
to the client UI. You can browse the proxy history and reissue individual
requests from the context of your browser, enabling the responses to be
fully processed and interpreted in the normal way.
n Utilities for manipulating the format of HTTP messages, such as converting
between different request methods and content encodings. These can
sometimes be useful when fine-tuning an attack such as cross-site scripting.