|
Burp Suite是一款信息安全从业人员必备的集 成型的渗透测试工具，它采用自动测试和半自动测试的方式，包含了 Proxy,Spider,Scanner,Intruder,Repeater,Sequencer,Decoder,Comparer等工具模块。通 过拦截HTTP/HTTPS的web数据包，充当浏览器和相关应用程序的中间人，进行拦截、修改、重放数据包进行测试，是web安全人员的一把必备的瑞士军刀。
File Size: 333.4 MB 档案大小:333.4 MB Burp Suite是一个可靠而实用的平台，为您提供了执行web应用程序安全性测试的简单方法。它为您提供了完全的控制，使您能够将高级手工技术与各种工具无缝地结合在一起，以支持整个测试过程。该实用程序易于使用和直观，不需要您执行高级操作来分析、扫描和利用web应用程序。它是高度可配置的，并提供有用的特性来帮助有经验的测试人员进行工作。 主窗口显示您可以选择的所有可用工具，并按您希望的方式设置每个工具的设置。 该应用程序被设计为可以与浏览器一起工作，它作为HTTP代理运行，因此来自浏览器的所有HTTP/s通信都将通过该实用程序。这样，如果您想要执行任何类型的测试，您需要配置浏览器来使用它。 您需要做的第一件事是确认应用程序的代理侦听器是活动的。只需导航到Proxy选项卡并查看代理侦听器部分。您应该会看到表中的一个条目勾选了Running复选框。你需要做的第二件事是配置你的浏览器使用应用的代理监听器作为它的HTTP代理服务器。最后，您需要配置浏览器，使其能够毫无问题地通过应用程序发送HTTP请求。 前面提到的实用程序使您能够完全控制您想要执行的所有操作，并获得关于您正在测试的web应用程序的详细信息和分析。使用入侵者、中继器、排序器和比较器等工具，您可以轻松执行不同的操作。 在爬行器的帮助下，您可以爬行应用程序来定位其内容和功能。您可以通过选择协议并指定主机名或IP范围来添加新的范围。然后，该实用程序监视所有传输的字节和排队的请求。 入侵者工具允许您对web应用程序执行攻击。只需设置主机名和端口号，定义一个或多个有效负载集，就完成了。还可以通过选中Target选项卡中的正确框来使用HTTP协议。 另一个自动化测试任务的工具叫做Sequencer，它分析应用程序会话令牌中的随机性质量。首先，您需要加载至少100个令牌，然后捕获所有请求。 总的来说，Burp Suite Free Edition可以让您以一种智能的方式实现您所需要的一切。它可以帮助您在浏览web应用程序时记录、分析或重放web请求。 专业版特点: ——打嗝代理 ——打嗝蜘蛛 ——打嗝中继器 ——打嗝定序器 ——打嗝译码器 ——打嗝比较器 ——打嗝入侵者 ——打嗝扫描仪 -保存和恢复 ——搜索 ——目标分析仪 ——内容发现 ——任务调度器 ——发布时间表 Burp Suite is a reliable and practical platform that provides you with a simple means of performing security testing of web applications. It gives you full control, letting you combine advanced manual techniques with various tools that seamlessly work together to support the entire testing process. The utility is easy-to-use and intuitive and does not require you to perform advanced actions in order to analyze, scan and exploit web apps. It is highly configurable and comes with useful features to assist experienced testers with their work.
The main window displays all the available tools you can choose from and set each one’s settings the way you want.
Being designed to work alongside your browser, the application functions as an HTTP proxy, thus all the HTTP/s traffic from your browser passes through the utility. This way, if you want to perform any kind of testing, you need to configure the browser to work with it. The first thing you need to do is to confirm that the app’s proxy listener is active. Simply navigate to the Proxy tab and take a look in the Proxy Listeners section. You should see an entry in the table with the Running check box ticked. The second thing you are required to do is to configure your browser to use the app’s proxy listener as its HTTP proxy server. Finally, you need to configure the browser to be able to send HTTP requests through the app without problems.
The previously mentioned utility gives you complete control over all of the actions you want to perform and get detailed information and analysis about the web applications you are testing. Using tools such as Intruder, Repeater, Sequencer and Comparer you are able to carry out different actions with ease. With the help of Spider, you can crawl an application to locate its content and functionality. You are able to add new scope by selecting the protocol and specifying the host name or the IP range. Then the utility monitors all the transferred bytes and queued requests.
The Intruder tool enables you to perform attacks against web apps. Simply set the host name and the port number, define one or more payload sets and you are done. You can also use the HTTP protocol by checking the proper box from the Target tab. Another tool that automates testing tasks is called Sequencer, which analyzes the quality of randomness in an application’s session tokens. Firstly, you need to load at least 100 tokens, then capture all the requests.
Overall, Burp Suite Free Edition lets you achieve everything you need, in a smart way. It helps you record, analyze or replay your web requests while you are browsing a web application. Features of Professional Edition:
- Burp Proxy
- Burp Spider
- Burp Repeater
- Burp Sequencer
- Burp Decoder
- Burp Comparer
- Burp Intruder
- Burp Scanner
- Save and Restore
- Search
- Target Analyzer
- Content Discovery
- Task Scheduler
- Release Schedule Homepage https://portswigger.net
Download 百度网盘
| 
发表于 2020-6-11 01:10:16
