Environmental Setup and Traffic Interception

To hunt for bugs efficiently, you’ll need a well-configured environment. This chapter guides you through setting up your hacking environment for web applications, focusing on configuring your browser to work with Burp Suite, a powerful web proxy that allows you to view and alter HTTP traffic.

---

Choosing an Operating System (OS)

Your choice of OS can limit the hacking tools available.

• I recommend using a Unix-based system, such as Kali Linux or macOS, because many open source hacking tools are written for them.
• Kali Linux is a Linux distribution specifically designed for digital forensics and hacking. It comes pre-installed with many useful bug bounty tools, including Burp Suite.

If you use another OS, you may need to learn different tools, but you can still follow the core concepts of this guide.

---

Setting Up the Essentials: Browser and Proxy

The Web Proxy

A proxy is software that sits between a client and a server. In hacking, it sits between your browser (client) and the web servers, acting as an intermediary to intercept and inspect all traffic.

$$\text{Browser} \longleftrightarrow \text{Proxy} \longleftrightarrow \text{Server}$$

Using a proxy like Burp Suite or Zed Attack Proxy (ZAP) is essential because it allows you to:

• View and modify the requests going out to the server and the responses coming back to your browser.
• Examine interesting requests to look for potential vulnerabilities.
• Exploit vulnerabilities by tampering with request parameters.

Example: You intercept a GET request to /emails/USER_ID that also contains a user\_id cookie. You can modify the USER_ID in both the URL and the cookie to another user’s ID to test for an Insecure Direct Object Reference (IDOR) vulnerability.

Setting Up Burp Suite and Firefox

Burp Suite is the most popular web proxy among bug bounty hunters. You can choose between the Community version (free, limited Intruder) and the Professional version (paid, includes a vulnerability scanner and full Intruder).

1. Configure the Browser to Use the Proxy

You need to tell your browser to route its traffic through Burp Suite.

1. Launch Firefox (recommended for simple setup).
2. Go to Preferences ➡️ General ➡️ Network Settings.
3. Select Manual proxy configuration.
4. Enter the IP address 127.0.0.1 (the localhost IP, identifying your current machine) and port 8080 for all protocol types (HTTP, SSL, FTP, etc.).
5. Click OK. This tells Firefox to route all traffic through the service running on your machine at port 8080 (where Burp runs by default).

2. Install Burp’s CA Certificate for HTTPS

Since Burp is acting as a “man-in-the-middle” to intercept encrypted HTTPS traffic, the browser will not trust it unless you install its Certificate Authority (CA) certificate.

1. With Burp open and running, and your Firefox proxy settings set to 127.0.0.1:8080, navigate to http://burp/ in Firefox.
2. Click CA Certificate at the top right to download the certificate file.
3. In Firefox, go to Preferences ➡️ Privacy & Security ➡️ Certificates ➡️ View Certificates ➡️ Authorities.
4. Click Import and select the file you just saved.
5. In the dialog, select Trust this CA to identify websites.
6. Restart Firefox.

You can now intercept both HTTP and HTTPS traffic.

Testing the Setup

1. In Burp, go to the Proxy tab and ensure Intercept is off is toggled to read Intercept is on.
2. In Firefox, visit a site like https://www.google.com/.
3. You should immediately see the request appear in Burp’s main proxy window. Click Forward to send the request to the server.
4. If you see the request and the website loads, your setup is correct.

---

Using Burp Suite Features

Burp Suite includes a variety of specialized tools (modules) that streamline the hacking process:

The Proxy

This is the central module for intercepting and modifying traffic.

• When Intercept is on, every request sent by your browser is captured by Burp and held until you choose to Forward it.
• You can modify the request (e.g., change headers or parameters) before forwarding it to the server.
• To send a request to another Burp module (like Repeater or Intruder), right-click the request and select Send to Module.

The Repeater

The Repeater is the tool you’ll use most often for manual testing and exploitation.

• It allows for manual, detailed modification of a single request and repeated sending of that request to the server.
• You can modify a request on the left side of the screen and click Send. The server’s response appears on the right.
• It’s ideal for manually exploiting bugs, trying to bypass filters, and testing different attack methods against the same endpoint.

The Intruder

The Intruder automates request sending, making it useful for high-volume, repetitive attacks. (The Community version is limited).

• Attack: It is primarily used for brute-forcing, where an attacker repeatedly submits requests using a list of predetermined values (payloads).
• Payload Positions: On the Positions screen, you specify which parts of the request (the payload positions) will be replaced by your list of payloads.
• Payloads: On the Payloads screen, you provide the list of values (e.g., a list of common passwords, sequential user IDs, or attack payload lists).

The Decoder

The Decoder is used to encode and decode data found in requests and responses.

• It’s used to decode application data (e.g., Base64 or URL-encoded content) to read or manipulate its plaintext, and then re-encode it before sending it back to the application.
• You can use Smart decode if you’re unsure of the encoding algorithm.

The Comparer

The Comparer is used to compare two requests or two responses.

• It highlights the differences between two blocks of text.
• It’s useful for examining how a small change in a request parameter impacts the response received from the server, which can hint at logic flaws or successful bypasses.

---

A Final Note on… Taking Notes

Organizational skills are critical for success in bug bounties. Information can quickly become hard to manage, especially when working on targets with large scopes.

Good notes help you:

• Track Potential Vulnerabilities: Jot down any weird behaviors, new features, misconfigurations, minor bugs, or suspicious endpoints. These unexploitable findings today could be chained with others for a critical exploit later.
• Plan and Track Progress: Keep track of the features you’ve tested and those you still need to check. This prevents you from wasting time retesting the same areas.
• Build a Technique Repository: Record details about each vulnerability you learn about: its theoretical concept, potential impact, exploitation steps, and sample Proof-of-Concept (POC) code.

Tips for Organization:

• Structure: Keep notes organized by sorting them into directories (e.g., a folder for each target like Facebook or Google), with subdirectories for specific topics (endpoints, recon results, draft reports, POCs).
• Tools: Find a note-taking process that works for you. Options include plaintext editors like Sublime Text, Markdown editors like Obsidian (excellent for linking ideas), or mind-mapping tools like XMind.
• Backup: Keep your notes in a centralized place (external hard drive or cloud storage like Google Drive or Dropbox) and back them up regularly.