Burp Suite: Web Security Testing — Panduan Lengkap

📋 Daftar Isi

Pengenalan Burp Suite
Setup Proxy & Browser
Proxy: Intercept & HTTP History
Repeater: Manual Testing
Intruder: Automated Attacks
Scanner: Automated Scanning
Decoder & Comparer
Workflow Penetration Testing
Quiz Pemahaman

1. Pengenalan Burp Suite

Burp Suite adalah platform terintegrasi untuk melakukan security testing pada aplikasi web. Dikembangkan oleh PortSwigger, Burp Suite telah menjadi tool paling populer dan diakui dalam industri web security — digunakan oleh penetration tester, bug bounty hunter, dan security auditor di seluruh dunia.

Burp Suite bekerja sebagai intercepting proxy yang ditempatkan antara browser dan server target. Ini memungkinkan Anda melihat, memodifikasi, dan menganalisis semua HTTP/HTTPS traffic yang melewatinya.

Edisi Burp Suite

Fitur	Community (Gratis)	Professional (Berbayar)	Enterprise
Proxy	✅	✅	✅
Repeater	✅	✅	✅
Intruder	⚠️ Throttled (lambat)	✅ Full speed	✅
Scanner	❌	✅ Automated	✅ CI/CD
Decoder	✅	✅	✅
Comparer	✅	✅	✅
Sequencer	✅	✅	✅
Extensions (BApp Store)	✅	✅	✅
Scan Scheduling	❌	❌	✅
Harga	Gratis	~$449/tahun	Custom

Komponen Utama Burp Suite

Diagram: Intruder Attack Types

🎯 Sniper 1 payload set → 1 position Iterate one...
🔨 Battering Ram 1 payload set → ALL positions S...
🔱 Pitchfork N payload sets → N positions Parall...
💣 Cluster Bomb N payload sets → all combos Cart...
/"Payload Distribution Pattern Sniper Battering R..."/

Contoh Penggunaan Intruder

Panduan — Intruder: Login Brute Force

# =============================================
# Contoh 1: Login Brute Force (Cluster Bomb)
# =============================================

# Langkah 1: Intercept login request
POST /login HTTP/1.1
Host: vulnerable-app.local
Content-Type: application/x-www-form-urlencoded

username=admin&password=password123

# Langkah 2: Kirim ke Intruder (Ctrl+I)
# Langkah 3: Set Attack Type = "Cluster Bomb"

# Langkah 4: Set payload positions (tandai dengan §)
# Burp otomatis mendeteksi parameter:
# username=§admin§&password=§password123§

# Langkah 5: Set payload
# Payload set 1 (username):
#   - Simple list: admin, user, root, administrator, test
#   - Atau load dari file: usernames.txt

# Payload set 2 (password):
#   - Simple list: password, 123456, admin, root, letmein
#   - Atau gunakan "Brute forcer" (karakter + panjang)
#   - Atau load dari file: passwords.txt (rockyou.txt)

# Langkah 6: Set Grep - Match (untuk filter hasil)
# Options → Grep - Match → Add:
#   - "Welcome" (indikasi login berhasil)
#   - "Dashboard" (redirect ke dashboard)
#   - "Invalid" (gagal login)

# Langkah 7: Start Attack
# Analisis hasil:
# - Status 302 (redirect) + "Welcome" → kemungkinan berhasil!
# - Response length berbeda → bisa jadi berhasil
# - Status 200 + "Invalid credentials" → gagal

# =============================================
# Contoh 2: Directory Fuzzing (Sniper)
# =============================================

# Request:
GET /§directory§ HTTP/1.1
Host: vulnerable-app.local

# Payload: Wordlist directory
# /usr/share/wordlists/dirb/common.txt
# Atau: /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

# Analisis:
# Status 200 → direktori ditemukan!
# Status 403 → direktori ada tapi dilarang
# Status 404 → tidak ditemukan

# =============================================
# Contoh 3: Parameter Fuzzing (Sniper)
# =============================================

# Request:
GET /api/users?id=§1§ HTTP/1.1

# Payload: Numbers 1-1000
# Type: Numbers, Range 1-1000, Step 1

# Atau fuzzing SQL injection payloads:
# ' OR 1=1 --
# ' UNION SELECT NULL--
# 1; DROP TABLE users--
# dll.

Alternatif: Turbo Intruder (Extension)

Python — Turbo Intruder Script

# Turbo Intruder — Extension untuk high-speed fuzzing
# Install dari BApp Store
# Bisa mengirim 30,000+ request/detik

# Contoh script Turbo Intruder:
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=5,
                           requestsPerConnection=100,
                           pipeline=False)

    # Queue requests dengan payload dari wordlist
    for word in open('/usr/share/wordlists/dirb/common.txt'):
        engine.queue(target.req, word.strip())

def handleResponse(req, interesting):
    # Hanya simpan response yang menarik
    if '200' in req.response or '301' in req.response:
        table.add(req)

6. Scanner: Automated Scanning (Professional)

Burp Scanner (hanya tersedia di Professional edition) melakukan automated vulnerability scanning pada aplikasi web. Scanner mendeteksi berbagai jenis vulnerability termasuk SQL Injection, XSS, CSRF, open redirect, insecure deserialization, dan banyak lagi. Scanner menggunakan teknik crawling (spider) untuk menemukan semua endpoint, lalu melakukan passive dan active scanning.

Jenis Scanning

Jenis	Deskripsi	Risiko
Passive Scan	Menganalisis traffic yang sudah ada tanpa mengirim request baru	Tidak ada — hanya observasi
Active Scan	Mengirim request berbahaya ke server untuk mendeteksi vulnerability	Bisa mempengaruhi server — gunakan hanya dengan izin
Crawl	Spider/meng-crawl aplikasi untuk menemukan semua halaman dan endpoint	Rendah — seperti bot biasa

Panduan — Burp Scanner Workflow

# =============================================
# Passive Scanner (Otomatis)
# =============================================
# Passive scanner selalu aktif di background
# Menganalisis SEMUA traffic yang melewati Proxy

# Yang dideteksi passive scanner:
# - Missing security headers (HSTS, CSP, X-Frame-Options)
# - Cookie tanpa HttpOnly/Secure/SameSite
# - Information disclosure (server version, error messages)
# - SSL/TLS issues
# - Sensitive data in URL parameters
# - Email addresses, internal IPs
# - Cross-domain script inclusion issues

# Hasil di: Dashboard → Advisory

# =============================================
# Active Scanner (Professional Only)
# =============================================

# Cara 1: Dari Target Site Map
# 1. Target → Site Map
# 2. Klik kanan pada target/host
# 3. "Actively scan this host"
# 4. Pilih scan type:
#    - Audit checks - Crawl and audit
#    - Crawl - Crawl only
#    - Audit - Audit only (tanpa crawl)

# Cara 2: Dari HTTP History
# 1. Select beberapa request
# 2. Klik kanan → "Do active scan"
# 3. Burp akan mengirim request aktif ke endpoint tersebut

# =============================================
# Scan Configuration
# =============================================

# Scan Configuration → New:
# 1. Audit Checks:
#    - SQL Injection: semua teknik (error-based, blind, UNION, dll)
#    - XSS: reflected, stored, DOM-based
#    - OS Command Injection
#    - Path Traversal
#    - File Inclusion (LFI/RFI)
#    - SSRF
#    - Open Redirect
#    - CSRF
#    - Insecure Deserialization
#    - XML External Entity (XXE)

# 2. Crawl Configuration:
#    - Maximum link depth
#    - Maximum URL parameters
#    - File extension handling
#    - Login credentials untuk authenticated scan

# 3. Resource Pool:
#    - Concurrent request limit
#    - Throttle between requests
#    - Pausing saat mendeteksi masalah

# =============================================
# Analisis Hasil Scan
# =============================================

# Dashboard → Advisory:
# - High: SQL Injection, RCE, Authentication Bypass
# - Medium: XSS, CSRF, Open Redirect
# - Low: Information Disclosure, Missing Headers
# - Information: Info gathering findings

# Setiap issue memiliki:
# - Severity (High/Medium/Low/Info)
# - Confidence (Certain/Firm/Tentative)
# - Detail: Request/Response yang mendeteksi issue
# - Remediation: Cara memperbaiki
# - References: OWASP, CWE, CVE

7. Decoder & Comparer

Decoder

Decoder adalah tool untuk meng-encode dan decode berbagai format data. Ini sangat berguna saat menganalisis payload, cookie, token, dan data tersembunyi dalam request.

Panduan — Burp Decoder

# =============================================
# Burp Decoder — Encode/Decode Formats
# =============================================

# Supported encoding/decoding:
# 1. URL encoding
#    Input:  hello world
#    Encoded: hello%20world

# 2. HTML encoding
#    Input:  <script>alert('xss')</script>
#    Encoded: &lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt;

# 3. Base64
#    Input:  Hello World
#    Encoded: SGVsbG8gV29ybGQ=

# 4. Hex
#    Input:  Hello
#    Encoded: 48656c6c6f

# 5. Octal
#    Input:  A
#    Encoded: 101

# 6. Binary
#    Input:  A
#    Encoded: 01000001

# 7. Gzip decompress
#    Untuk meng-decode compressed response body

# =============================================
# Smart Decode
# =============================================
# Burp Decoder bisa auto-detect format dan decode bertingkat:
# Contoh:
# URL encoded → Base64 → Hex → Hasil akhir

# Input: SGVsbG8%3D
# Smart decode → "Hello"

# =============================================
# Contoh Praktis: Decode JWT Token
# =============================================

# JWT Cookie: eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxLCJyb2xlIjoiYWRtaW4ifQ.xxx

# Bagian 1 (Header): eyJhbGciOiJIUzI1NiJ9
# Base64 decode → {"alg":"HS256"}

# Bagian 2 (Payload): eyJ1c2VyX2lkIjoxLCJyb2xlIjoiYWRtaW4ifQ
# Base64 decode → {"user_id":1,"role":"admin"}

# Bagian 3 (Signature): xxx
# Ini signature yang perlu di-crack atau bypass

# =============================================
# Comparer — Membandingkan Response
# =============================================

# Fungsi: Membandingkan dua request/response secara visual

# Penggunaan:
# 1. Select dua item di HTTP History
# 2. Klik kanan → "Send to Comparer"
# 3. Buka tab Comparer
# 4. Pilih "Words" atau "Bytes" comparison
# 5. Perbedaan akan di-highlight

# Contoh penggunaan:
# - Bandingkan response login berhasil vs gagal
# - Bandingkan response sebelum dan sesudah exploit
# - Bandingkan response dari dua IDOR endpoint
# - Mendeteksi perubahan kecil yang mengindikasikan vulnerability

Extensions yang Direkomendasikan

Panduan — Essential Burp Extensions (BApp Store)

# =============================================
# Top Extensions dari BApp Store
# =============================================

# Extender → BApp Store

# 1. Autorize — Authorization Testing
#    Otomatis menguji IDOR dan broken access control
#    Kirim request sebagai user A, Autorize otomatis
#    mengirim ulang sebagai user B dan membandingkan

# 2. Logger++ — Advanced Logging
#    HTTP history yang lebih powerful dengan filter lanjutan

# 3. JSON Beautifier
#    Format JSON response agar mudah dibaca

# 4. JWT Editor — JWT Token Manipulation
#    Decode, edit, sign, dan crack JWT tokens

# 5. Turbo Intruder — High-Speed Fuzzing
#    Python-based high-performance intruder
#    Bisa 30,000+ requests/detik

# 6. Active Scan++ — Enhanced Active Scan
#    Tambahan scan checks yang tidak ada di default scanner

# 7. InQL — GraphQL Security Testing
#    Tools untuk testing GraphQL API

# 8. Param Miner — Hidden Parameter Discovery
#    Menemukan parameter tersembunyi (hidden inputs, headers)

# 9. Upload Scanner — File Upload Testing
#    Menguji upload bypass techniques

# 10. Collaborator Everywhere
#     Inject Collaborator payloads di semua request
#     Untuk blind vulnerability detection (SSRF, blind RCE)

# =============================================
# Collaborator — Out-of-Band Testing
# =============================================

# Burp Collaborator memungkinkan deteksi "blind" vulnerabilities:
# - Blind SQL Injection
# - Blind OS Command Injection
# - SSRF
# - Out-of-Band XXE

# Cara kerja:
# 1. Burp generate unique subdomain: xyz.burpcollaborator.net
# 2. Inject ke payload: http://xyz.burpcollaborator.net
# 3. Jika server melakukan request ke domain tersebut
#    → Vulnerability terdeteksi!

# Di Professional Edition, Collaborator otomatis tersedia
# Di Community, gunakan alternative: Canarytokens.org

Burp Suite: Web Security Testing — Panduan Lengkap

1. Pengenalan Burp Suite

Edisi Burp Suite

Komponen Utama Burp Suite

Contoh Penggunaan Intruder

Alternatif: Turbo Intruder (Extension)

6. Scanner: Automated Scanning (Professional)

Jenis Scanning

7. Decoder & Comparer

Decoder

8. Workflow Penetration Testing dengan Burp Suite

Langkah-Langkah Comprehensive

Extensions yang Direkomendasikan

9. Quiz: Uji Pemahamanmu!

Pertanyaan 1: Apa fungsi utama Burp Suite Proxy?

Pertanyaan 2: Intruder attack type apa yang mencoba SEMUA kombinasi dari beberapa payload set?

Pertanyaan 3: Tool apa dalam Burp Suite yang digunakan untuk mengirim request secara manual berkali-kali?

Pertanyaan 4: Apa perbedaan passive scan dan active scan di Burp Suite?

Pertanyaan 5: Mengapa harus menginstall CA certificate dari Burp Suite di browser?

📚 Artikel Terkait

📬 Dapatkan Tutorial Terbaru