I get asked a lot about what tooling I’m using these days for web app pentesting, and why I’m not using Kali for everything. Seriously, stop telling me to use Kali. I like it, it’s just fine, but I’m not ever going to use it as my daily driver, and sometimes I just want to be able to look at some API calls intelligently from my main OS.

关于这些天我正在使用哪些工具进行Web应用程序渗透测试，以及为什么我不使用Kali进行所有测试，我被问到很多。 认真地说，别再告诉我要使用Kali。 我喜欢它，这很好，但是我永远不会将其用作日常驱动程序，有时我只是想能够从主操作系统中智能地查看一些API调用。

Say what you want about Ubuntu, it’s certainly no Arch Linux, but for what I do (which, these days, is mostly development) it’s stable, easy to use, and gives me enough control to not complain very much. And hey, it’s not Windows. So, anyway, I’ve put together a little guide to help you get started pentesting from Ubuntu with Burp Suite.

说出您想要的Ubuntu， 肯定不是Arch Linux ，但对于我所做的(如今主要是开发工作)，它稳定，易于使用，并提供了足够的控制权，使我不会抱怨太多。 嘿，这不是Windows。 因此，无论如何，我整理了一些指南，以帮助您开始使用Burp Suite从Ubuntu开始进行渗透测试。

安装 (Installation)

Head over to Portswigger and get the download for Burp Suite Community Edition. You’ll get what is possibly the largest bash script I’ve ever seen in my life. So, in your terminal, migrate to whichever folder it downloaded to an run the following:

前往Portswigger并获得Burp Suite社区版的下载。 您将获得我一生中见过的最大的bash脚本。 因此，在您的终端中，迁移到它下载的任何文件夹，然后运行以下命令：

chmod +x burpsuite_community_linux_v<your version here>.sh
./burpsuite_community_linux_v<your version here>.sh

That’ll take a moment to run, and when it’s done you’ll have the latest version of Burp Suite installed. I know, it’s surprising.

这将需要一些时间才能运行，完成后，您将安装最新版本的Burp Suite。 我知道，这令人惊讶。

最初设定 (Initial setup)

Open up the program (either by running BurpSuiteCommunity in your terminal or hitting the super/windows key and searching for it). You’ll see a pretty little splash screen, and then this:

打开程序(通过在终端中运行BurpSuiteCommunity或按超级/ Windows键并进行搜索)。 您会看到一个很小的启动屏幕，然后显示以下内容：

Hit next…

下一个…

Hit next again…

再次点击…

Alright, now we’re in business. Next, you’ll want to set a few of the Proxy options so you can actually use the damn thing. Go to the proxy tab:

好吧，现在我们在做生意。 接下来，您需要设置一些代理选项，以便您可以实际使用该死的东西。 转到代理标签：

Click on the options tab. Here, you can set up the listeners that will essentially allow you to do a Man in the Middle attack on yourself, so you can view/modify/replay traffic in real time. Modify the current entry to allow invisible proxying, and create a new entry on port 8443 for HTTPS traffic, as seen below:

单击选项选项卡。 在这里，您可以设置侦听器，从本质上讲，您可以对自己进行中间人攻击，因此您可以实时查看/修改/重播流量。 修改当前条目以允许隐形代理，并在端口8443上为HTTPS流量创建一个新条目，如下所示：

Remember to check off “Force use of TLS” when you create the listener for HTTPS:

创建HTTPS侦听器时，请记住选中“强制使用TLS”：

Bonus: if you never want to do this again, click the Burp menu (top left of main window) >> User Options >> Save user options and name the file something like burp.json . Now, you can load this template when you start a new project.

奖励：如果您不想再执行此操作，请单击Burp菜单(在主窗口的左上角)>>用户选项>>保存用户选项，并将文件命名为burp.json 。 现在，您可以在开始新项目时加载此模板。

设置浏览器 (Setting up your browser)

To make use of Burp, we need some source of traffic. Let’s setup Firefox to be our testing browser. Open up Firefox and go to the preferences page. At the bottom, you’ll see Network Settings:

要使用Burp，我们需要一些流量来源。 让我们将Firefox设置为我们的测试浏览器。 打开Firefox并转到首选项页面。 在底部，您将看到网络设置：

Click on the Settings button beside that section, and you’ll see a window with proxy options pop up:

单击该部分旁边的Settings按钮，您将看到一个窗口，其中弹出代理选项：

Enter the loopback address for each, since Burp Suite is running locally, and make sure you use the correct port numbers. If you’ve been following this guide exactly, they will be 8080 for HTTP and 8443 for HTTPS.

由于Burp Suite在本地运行，请为每个地址输入回送地址，并确保使用正确的端口号。 如果您一直严格按照本指南进行操作，那么对于HTTP，它们将是8080，对于HTTPS，它将是8443。

Ok, now you have the means to direct the traffic to Burp Suite. Now, you need to force your browser, who really just wants to be secure, to trust Burp. So, in your browser, navigate to http://burp (exactly). You’ll see this nifty little screen:

好的，现在您可以将流量定向到Burp Suite。 现在，您需要迫使实际上只是想确保安全的浏览器信任Burp。 因此，在您的浏览器中，精确地导航到http://burp 。 您会看到一个漂亮的小屏幕：

Hidden in the top right corner is what we’re after. Click the ‘CA Certificate’ link and save it:

隐藏在右上角的是我们想要的。 点击“ CA证书”链接并保存：

That is the certificate that Burp Suite uses when signing HTTPS traffic. If you were only going to proxy HTTP traffic (good luck), you wouldn’t really need this, but that’s not the world we live in. Next, you’ll need to import this certificate into Firefox’s trusted certificate store. Go back to Preferences, and click on the Privacy & Security tab:

那是Burp Suite在签署HTTPS流量时使用的证书。 如果您只打算代理HTTP通信(祝您好运)，那么您实际上并不需要它，但这不是我们所生活的世界。接下来，您需要将此证书导入Firefox的受信任证书存储中。 返回“首选项”，然后单击“隐私和安全性”选项卡：

Near the bottom, click on ‘View Certificates’. You’ll see a window listing all of the certificates you currently trust. At the bottom, click Import:

在底部附近，单击“查看证书”。 您将看到一个窗口，列出了您当前信任的所有证书。 在底部，单击导入：

Navigate to the folder where you saved the certificate from earlier and import it. Firefox will ask how you want to use it:

浏览至先前保存证书的文件夹，然后将其导入。 Firefox会询问您如何使用它：

We don’t really need this to identify anything but websites, so for the sake of ‘scurity, just check off the first box. Older versions of Firefox had more options, but I can’t recall what they were and I’m too lazy to look it up. Use your best judgement, security professional.

除了网站之外，我们实际上不需要此标识，因此，为了确保安全，只需选中第一个框。 较旧版本的Firefox有更多选择，但我不记得它们是什么，而且我懒得查找它。 使用您最好的判断，安全专家。

看一些交通 (Looking at some traffic)

Now, we could go back to Burp and click on the proxy tab while navigating around the web all willy-nilly and capture everything going to and fro. But what about this project you’re working on where you really just need to see traffic from a certain domain or subdomain?

现在，我们可以回到Burp并单击“代理”选项卡，同时在网络上随意浏览并捕获来回的一切。 但是，您正在从事的这个项目又是什么，您真的只需要查看来自特定域或子域的流量就可以了？

Easy. Go to the Target tab:

简单。 转到目标选项卡：

We’re highly advanced, here, so click on the ‘Use advanced scope control’ checkbox. Really, it’s just easier to use I think:

我们的位置非常先进，因此请点击“使用高级范围控件”复选框。 确实，我认为使用起来更简单：

So, pretend we’re wanting to look at Twitter traffic and only want to view traffic from subdomains (like api.twitter.com). You would set a new target scope like so:

因此，假装我们只想查看Twitter流量，而只想查看来自子域(如api.twitter.com)的流量。 您将设置一个新的目标范围，如下所示：

Going back to the proxy tab, you may have to change the filters in the HTTP history to ensure you only see items from your scope. Click on the Filter bar right above the traffic history and make sure ‘Show only in-scope items’ is checked off:

返回到“代理”选项卡，您可能必须更改HTTP历史记录中的过滤器，以确保仅看到范围内的项目。 点击流量历史记录上方的过滤器栏，并确保已选中“仅显示范围内的物品”：

Navigate to Twitter, log in, and click around on stuff. You can now see only the traffic coming from Twitter subdomains (the Repeater tab is shown below):

导航到Twitter，登录，然后在内容上单击。 现在，您只能看到来自Twitter子域的流量(“中继器”选项卡如下所示)：

You’ll notice that I’ve magically switched to dark mode, check this article out to be a big copy cat and do the same.

您会注意到，我已经神奇地切换到黑暗模式， 将本文检查为模仿大猫，然后执行相同操作。

结语 (Wrapping it up)

That’s pretty much it, you should be good to go. So what’s next? Anything you want really. I use Burp to pentest (obviously), assist with API development, and diagnose weird website issues. If you haven’t worked it into your web app pentesting work flow, do it now!

差不多就可以了，您应该很好。 下一个是什么？ 您真正想要的任何东西。 我使用Burp进行渗透测试(显然)，协助API开发，并诊断奇怪的网站问题。 如果您尚未将其纳入网络应用程序渗透测试工作流程中，请立即执行！

关于作者 (About the author)

Andrew is a CyberSecurity Engineer and Software Developer specializing in Phishing Simulation. When he’s not writing articles, you can catch him on Twitter or Linkedin.

安德鲁(Andrew)是专门从事网络钓鱼模拟的网络安全工程师和软件开发人员。 当他不写文章时，您可以在 Twitter 或 Linkedin 上找到他 。