infosecgirls
Appsec
Appsec
  • Introduction
  • Application Details
    • VM - Pre-req
    • Import Virtual Machines
    • Access Mutillidae Web Application
  • INITIAL SETUP WITH OWASP ZAP
    • OWASP ZAP
    • Setup OWASP ZAP
    • Modes
    • Automated Scan
    • Report Generation
  • Initial Setup with Burp
    • Start Burp Suite
    • Add FoxyProxy Addon
    • Add New Proxy In FoxyProxy
    • Configure Proxy Listener
    • Install Burp's CA Certificate In Firefox
    • Getting Rid of Unnecessary Browser Traffic
  • Quick Basics
    • Disable Intercept Mode in Burp
    • Enable Intercept Mode in Burp
    • Send to Repeater
    • Send to Comparer
  • Web Application Pentesting
    • A1 - Injection
      • SQL Injection with bWAPP
      • SQL Injection in DVNA
      • Command Injection in DVNA
    • A2 - Broken Authentication
      • Broken Authentication with bWAPP
    • A3 - Sensitive Data Exposure
      • Sensitive Data Exposure - DVNA
    • A4 - XML External Entities (XXE)
      • XML External Entity (XXE) Injection - Mutillidae
      • XML External Entity (XXE) Injection - DVNA
    • A5 - Broken Access Control
      • Broken Access Control - DVNA
    • A6 - Security Misconfiguration
      • Security Misconfiguration in DVNA
      • Security Misconfiguration in Mutillidae
      • Security Misconfiguration in Security Shepherd
    • A7 - Cross-Site Scripting (XSS)
      • Reflected XSS
      • DOM XSS
      • Stored XSS - Mutillidae
      • XSS - Sending data to remote server
    • A8 - Insecure Deserialization
      • Insecure Deserialization - DVNA
    • A9 - Using Components with Known Vulnerabilities
      • Using Components with Known Vulnerabilities - DVNA
    • 10 - Insufficient Logging & Monitoring
    • References
    • About Us
  • Additional Content
    • Insecure Direct Object Reference
    • Security Misconfiguration
    • Password Guessing Attack
    • User Enumeration
      • Unauthenticated User Access
      • Create a New User
      • Authenticated User Access
      • Intruder: Set Positions
      • Intruder: Define Payload
      • Intruder: Configure Grep - Extract
      • Trigger Attack & Save Results
    • Custom Iterator
    • Null Payload
    • Request in Browser: Privilege Escalation Check
  • Burp Extenders
    • Target
    • Proxy
    • Intruder
    • Repeater
    • Sequencer
    • Decoder
    • Comparer
    • Extender
Powered by GitBook
On this page
  • In Burp, go to "Target" > "Site map" tab, and get familiar with the user interface.
  • Scope

Was this helpful?

  1. Burp Extenders

Target

This tool contains detailed information about your target applications, and lets you drive the process of testing for vulnerabilities.

PreviousRequest in Browser: Privilege Escalation CheckNextProxy

Last updated 5 years ago

Was this helpful?

In Burp, go to "Target" > "Site map" tab, and get familiar with the user interface.

Switch to "Target" > "Scope" tab.

Switch to "Target" > "Issue definitions" tab.

  1. In Firefox, explore the Security Shepherd web application by following links and submitting forms.

  2. Observe the site map getting populated with URLs as you explore the target website. In site map, the items that have been manually requested in browser appear in black, while other items appear in gray.

Scope

  1. Select a URL in the "Target" > "Site map" tab.

  2. Right click on the chosen URL and select "Add to scope" option from the context menu.

Select "No" in the "Proxy history logging" prompt. This is because we want to see all requests (in or out of scope) that are made while accessing the target web application.

Go to "Target" > "Scope" tab to verify if the chosen URL was included in scope.

Return to "Target" > "Site map" tab, and select a different URL in the "Contents" section.

Right click on the chosen URL and select "Copy URL" option from the context menu.

Exclude from Scope

  1. Go to "Target" > "Scope" tab, and click on "Paste URL" button under the "Exclude from scope" section.

2. You could, now, configure suitable display filters on the site map and Proxy history tabs, to hide from view items that you are not currently interested in.

3. Go to "Target" > "Site map" tab.

4. Click on the Filter bar.

5. Select the checkbox labeled as Show only in-scope items.

6. Click anywhere outside of the filter-box.

7. Only in-scope items should be visible in the site map, now.