Mobile Web Application Assessment (Android Emulator + Burpsuite)

In this tutorial, i will show how to set up an environment to perform Web Application assessment. In this tutorial, you will need to download and install the following things first:

1) Android Emulator  

(http://developer.android.com/sdk/index.html)

2) BurpSuite 

(http://portswigger.net/burp/download.HTML) 

3) Firefox Addon Proxy Selector

(https://addons.mozilla.org/en-US/firefox/addon/proxy-selector/)

This tutorial assumes that you have downloaded and installed the above items. I will proceed to show how to set up the Android Emulator and Burpsuite.

1) Click on the SDK Manager

2) Click on Tools > Manage AVDs

3) Select the first AVD
4) Click Start

5) Click Launch

6) Allow Android to boot up. This can take up to 5mins

7) You will get to this screen once successfully loaded

8) Open Burpsuite and set the Specific Address to the local machine's IP address

9) On Android, go to Settings > Wireless & Networks > Mobile Networks > Access Point Names > Select the default APN > Edit Access Point and se the Proxy IP and the Port

10) Open up Firefox, go to the Proxy Selector and select Burpsuite-MobileApp (you may need to change the IP address accordingly to your given IP address)

*Take note that upon installing the Proxy Selector addon, you will need to set up the proxy settings manually before you can perform this portion.

11) Open the Browser in Android and ensure that BurpSuite Interceptor is set to On.
12) Traffic will be intercepted by Burp proxy.

There You Go! Now You Have My Permission to Intercept!

SPIDERING Website using Burp Spider

Burp Spider is a tool for automatically crawling web applications. While it is generally preferable to map applications manually, you can use Burp Spider to partially automate this process for very large applications, or when you are short of time. - http://portswigger.net/burp/help/spider_gettingstarted.html

Note: Using Burp Spider may result in unexpected effects in some applications. Until you are fully familiar with its functionality and settings, you should only use Burp Spider against non-production systems.


Before performing this, ensure that the proxy has been set and configured properly. Click here to know how to set the proxy up: http://securityg33k.blogspot.sg/2013/07/data-manipulation-intercepting-http.html

Click on Spider and Tick the 'spider running' option

In this example, we are not going to perform any traffic interception. Go to Proxy and ensure that the 'Intercept is Off'

In this example we are going to use a testing site by Acunetix: http://testphp.vulnweb.com

Now go to the 'Target' tab in Burp Suite and you will notice a set of links. Right click on the link that we want to spider and choose 'spider this host'

Now go to the 'spider' tab and you will notice the spidering action being performed.

Once done, go back to the 'Target' tab and expand the list under the site you Spidered. This will give us the list of items in the website for analysis and review.

Download Burp Suite here: http://www.portswigger.net/burp/download.html

Data Manipulation - Intercepting HTTP Traffic using Burp Suite Proxy

"Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security vulnerabilities." - http://www.portswigger.net/burp/

Open Burpsuite in BackTrack

Click on the Proxy tab. By default, the settings is set to listening on port 8080.

Next, go to your browser and set your proxy settings to 127.0.0.1:8080

In this example, we are going to use a weakly configured test website to demonstrate what Burp Suite Proxy can do.

On your browser, go to www.bayden.com/sandbox/shop/ and click enter. You will notice that the website is trying to load..

Now, on Burp Suite, you will see that the traffic has been intercepted. You can see the data it is withholding. Click Forward to allow the traffic to go through.

On your browser, you will notice that the website now has loaded properly. Check out the price for the laptop... it costs $1095. 

Let's try to change that shall we? Let's order 3 sets of it and click on Check Out.

On the Burp Suite Proxy, you will notice the HTTP traffic and what can we see here is the price of the laptop.

In the Params tab, you can see in a better format the cost of the laptop.

Let's change the price and put it to 65.00. Once changed, click forward.

And now you notice that you have successfully purchase 3 laptops for only $195.

------------------------------------------------------------------------------------------------------

Note: The site http://www.bayden.com/sandbox/shop/ is a site for testing, made available for those who wants to perform a POC (proof of concept) on this security issue.

Download Burp Suite here: http://www.portswigger.net/burp/download.html

Check out my previous blogpost on how to perform the same thing on Firefox and IE browser here: http://securityg33k.blogspot.sg/2013/07/5000-to-50-tamperingmanipulating-data.html