TEAM Proofreaders

&
Editor-in-Chief
 Betatesters:
Joanna Kretowicz 

[email protected]
Lee McKenzie
Editors:

Marta Sienicka
 Avi Benchimol

[email protected]
Bernhard Waldecker
Marta Strzelec

[email protected] Hammad Arshed

Anna Kondzierska
 Ivan Gutierrez Agramont

[email protected]
John Webb
Proofreader:
Lee McKenzie
David von Vistauxx
Senior Consultant/Publisher: 

Paweł Marciniak  Tom Updegrove

CEO: 
 K S Abhiraj
Joanna Kretowicz 

[email protected]  greg mckoy
Marketing Director: 

Ayo Tayo balogun
Joanna Kretowicz 

[email protected]
Jonus Gerrits
DTP 

Marta Sienicka
 Michal Jáchim
[email protected]
Mitch Impey
Cover Design
Hiep Nguyen Duc Wayne Kearns

Publisher 
 Robert Fling

Hakin9 Media Sp. z o.o.

02-676 Warszawa
 Francesco Mura
ul. Postępu 17D 

Phone: 1 917 338 3631  Paul Mellen

www.hakin9.org Matthew Sabin

All trademarks, trade names, or logos mentioned or used are the

property of their respective owners.

The techniques described in our articles may only be used in private,

local networks. The editors hold no responsibility for misuse of the
presented techniques or consequent data loss.
Dear Readers!
We would like to present you our newest issue, which will mainly focus on Burp

Suite. We gathered all articles we had about this tool, added new ones and pre-

pared this compendium. Tutorials, step by step guides, and more can be found

in this edition. Hamed Farid will show you how to Extend Burp with Python. Jun-

ior Carreiro wrote an article to show you how you can use Burp to perform fuzz-

ing web applications and discover SQL Injection flaws.

If you get tired of Burp, I recommend reading two amazing articles: “Demystify-

ing the Dark Web” by Sayani Banerjee and “Browser Exploits: PasteJacking And

XSSJacking” by Samrat Das. We hope that you will find many interesting articles

inside the magazine and that you will have time to read them all.

Again special thanks to the Beta testers and Proofreaders who helped with this

issue. Without your assistance there would not be a Hakin9 Magazine!

Enjoy the issue,

Hakin9 Team
What is Burp Suite?
7
by Pprasoon Nigam

Brute forcing passwords using WPScan and Burp Suite,

Kali Linux 2.0 60
by Tomasz Krupa

Extending Burp Using Python

71
by Hamed Farid

Web Application Pentesting Tools:

Burp Suite Playbook 85

by Pranav Jagtap

Harnessing the lesser known “Burp macros” for

Penetration Testing Web Apps  117
by Samrat Das

Automating Manual Security Testing Using Burp

Macros to Accelerate Manual Security testing
130
by Prashant Kumar Khare and Sarang Dabadghao

5
Burp for fuzzing
144
by Junior Carreiro

Web Applications Penetration Testing Tools -

Overview  156
by Andrea Cavallini

Demystifying the Dark Web

163
by Sayani Banerjee

Browser Exploits: PasteJacking And XSSJacking

by Samrat Das
170

6
Brute forcing passwords using WPScan and

Burp Suite, Kali Linux 2.0

by Tomasz Krupa
 ABOUT THE AUTHOR

Tomasz Krupa
Security Hobbyist and Researcher, working over 9

years with Linux Debian systems, big fan of London Ar-

senal. LPIC-1 and AWS Solutions Architect Certified.

8
 Brute Forcing Passwords Using WPScan And Burp Suite, Kali Linux 2.0

“Move swift as the Wind and closely-formed as the Wood. Attack like the Fire and be still as the Mountain.”

― Sun Tzu, The Art of War

In this article we will be testing web security of the popular WordPress engine by simulating a brute force attack using
my two favourite Linux Kali tools: WPScan and Burp Suite.

The Tools:

1) WPScan is a WordPress vulnerability scanner, written entirely in Ruby, capable of detecting security vulner-
abilities in websites hosted using WordPress and is pre-installed in Kali Linux.

WPScan is also capable of:

• Username enumeration

• Multi-threaded password cracking using a supplied password list

• Version enumeration

• Vulnerability enumeration

• Plugin enumeration and plugin vulnerability enumeration

• Theme enumeration

• Directory listing

2) Burp Suite is a Java based Web Penetration Testing framework and it’s a tool used by information security
professionals to identify vulnerabilities and verify attack vectors for web-based applications.

In its simplest form, Burp Suite can be classified as an “Interception Proxy”. Internet traffic is being routed through
the proxy which then acts as a sort of Man in the Middle by capturing and analysing each request and response.

Individual HTTP requests can be paused, manipulated and replayed back to the web server for targeted analysis of spe-
cific injection points, which then can be translated into automated fuzzing attacks to discover potentially unintended
application behaviours, crashes and error messages.

The Victim:

WordPress is a free and open-source content management system (CMS) based on PHP and MySQL, supporting more
than 60 million websites worldwide (according to Wikipedia).

9
 Brute Forcing Passwords Using WPScan And Burp Suite, Kali Linux 2.0

As of February 2017, WordPress was used by more than 27.5% of the top 10 million websites and it’s reportedly the
most popular website management for blogging systems in the Web.

From the architecture perspective, WordPress engine is a front controller, routing all requests for non-static URIs to a
single PHP file that parses the URI and identifies the target page.

The community of users built around the product and user-friendly design resulted in a huge library of plugins and
themes (both free and paid), which can truly transform a static website into a dynamic and vibrant CMS.

Scenario:

Target:

Linux Ubuntu 14.06 running standard LAMP stack

WordPress version 4.8.2

Default security plugins

Information gathering - key points:

1) Gather as much information as possible about the application and the infrastructure it resides on.

2) When testing the application, look for any entry points where user input is accepted and dynamic content is
generated. Then, probe these areas for weaknesses in input validation, session manipulation, and authenti-
cation and information leakage.

Any information leak should be recorded and used to re-assess the overall understanding of the application and how it
works.

Note: Above command might return “Stop User enumerating plugin” (as below)- which is expected on the
latest versions of WordPress.

Pen testing WordPress engine using WPScan:

Step 1) start with updating the database on WPScan:

wpscan --update

10
 ! ! ! !

Browser Exploits: PasteJacking and XSSJacking

by Samrat Das
 ABOUT THE AUTHOR

Samrat Das
Samrat Das is a senior security researcher currently working for Se-

cureLayer7 Technologies India. His interests revolve in Penetration

Testing, Reverse Engineering and Fuzzing. He can be reached on:

https://twitter.com/Samrat_Das93 and www.linkedin.com/in/sam18d

12
 Browser Exploits: PasteJacking And XSSJacking

Hi Readers, in the field of penetration testing, we all know attacks such as Clickjacking, Cross Site Scripting. These are
attacks from most commonly included OWASP Top 10 test cases.

However, what about learning some client side exploits which can help us chain unexpected and not so commonly ac-
cepted attacks to perform account takeover, hijacking sessions, manipulating user clipboard remotely? Sounds excit-
ing? Well, that’s what XSSJacking and Paste Jacking is all out, read on to know more:

Today we will look into some advanced attack vectors which have been lately around sometime but not all are aware of
the attack.

Pastejacking. The art of changing what you copy from web pages.

What is pastejacking?

• Pastejacking is a method that malicious websites employ to take control of your computers’ clipboard and
change its content to something harmful without your knowledge.

• This feature can allow malicious websites to take over your computers’ clipboard.

• When you copy something and paste it to your clipboard, the website can run one or more commands using
your browser.

• The method can be used to change the Clipboard contents.

• If you paste something directly to the Terminals!? Result: Lethal Commands Executed

Attack scenario:

Here we have a sample page which shows a text: “who am i?” as bait for copying. Once this text is selected, it will auto-
matically get replaced in the clipboard with echo " I @// H4k3r" .

13
 Browser Exploits: PasteJacking And XSSJacking

The code for pastejacking:

<html>

<body>

<h3>

<h1> <marquee> "Test PasteJacking Attack" </marquee>

<body bg color= blue

</br>

<body bgcolor="#E6E6FA">

<center>

<h4> <p>"who am i ?"</p>

<script>

function copyTextToClipboard(text) {

var textArea = document.createElement("textarea");

textArea.value = text;

document.body.appendChild(textArea);

textArea.select();

try {

var successful = document.execCommand('copy');

14