The Ultimate Guide to Learning Burp Suite for FREE – Source: securityboulevard.com

July 19, 2023
Post Author / Publisher: Security Boulevard

CISO2CISO post categories: API Hacking Fundamentals, Cyber Security News, rss-feed-post-generator-echo, Security Bloggers Network, Security Boulevard

Rate this post

Source: securityboulevard.com – Author: Dana Epp

Introduction

When it comes to the tools of the trade for web app and API security testing, Burp Suite should be at the top of your list. It’s a powerful, comprehensive suite of tools that can be used to perform manual and automated security assessments.

But how do you get started learning Burp Suite?

Fortunately, there are plenty of resources out there that will help you get up to speed on the ins and outs of Burp Suite without having to spend a dime. From tutorials to online courses, this guide will give you all the information you need to get started using Burp Suite for free.

Burp Suite Tutorials

One of the first places to look when it comes to learning Burp Suite is online tutorials. There are plenty of options out there, from beginner-level tutorials that can help you get your feet wet with the tools to more advanced tutorials that will help you build your skills with more complex tools and techniques.

Official Tutorials

A great place to start is the official Burp Suite documentation, which includes a comprehensive set of tutorials on the suite’s features. From setting up and configuring Burp Suite to using its many tools for security testing, there are plenty of resources to get you started.

For beginner-level tutorials, you can also check out the Burp Suite YouTube channel. The channel includes various videos covering topics from basic setup to more advanced features and tools. My favorites are the Burp Suite Shorts.

Third-Party Tutorials

In addition to the official stuff from PortSwigger, there are plenty of other tutorials available online from both professional security researchers and enthusiasts alike. From blog posts and articles to video series, these resources can be great starting points for learning Burp Suite.

A great starting point is John Hammond’s Burpsuite Basics. BugCrowd University also has a pretty good Introduction to Burp Suite. They also have published an Advanced Burp Suite tutorial worth checking out from @JR0ch17.

Speaking of bugs, if you are into bug bounty hunting, you might appreciate the Burp Hacks for Bounty Hunters video that HackerOne publishes as part of their Hacker101 series. You might also want to check out their advanced tutorial on Maximizing Burp.

Or maybe check out David Bombal’s video, where he invites Daniel Lowrie from ITProTV to talk about The basics of Burp Suite.

Of course, I’ve written several articles related to Burp Suite. Some of the more popular ones include:

Online Courses

In addition to tutorials, there are plenty of online courses available that can help you get started with Burp Suite. These courses range from beginner-level overviews of the suite’s features to more advanced topics that will help you take your skills to the next level.

Burp Suite Pro Essentials course

One great option is to follow the Burp Suite Essentials playlist from Portswigger. This course is tailored for appsec professionals who own Burp Suite Professional. The lesson plan includes:

TryHackMe rooms/courses

Of course, being a big fan of TryHackMe, I have a few recommendations of rooms you can join to learn even more. The first couple are FREE. The last three do require a VIP membership. If you don’t have a VIP membership, consider subscribing to the API Hacker Inner Circle newsletter; I regularly gift 30-day VIP passes.

Anyways, here are the rooms I recommend you check out that are related to Burp Suite:

If you join TryHackMe, make sure you friend me. Being ranked #1 in Canada and in the top 50 in the world, I’m always looking for people to engage and chat with through THM.

@Agarri_FR Workshops at NahamCon 2023 & Northsec 2023

So during Nahamcon 2023, Nicolas Gregoire (aka @Agarri_FR) hosted a 70-minute full hands-on workshop called “Automation tricks for Burp Suite Pro”. The targets used during the demos are provided as free Docker containers, so you can follow along and practice.

Here is the workshop:

You can download the slides here.

Speaking of Nicholas, he and his crew manage the @MasteringBurp Twitter account, which you should follow.

He also recently talked at Northsec 2023 called “Tips and tricks for Burp Suite Pro, ten years later”. This 30-minute talk details some efficiency tips, covering both core features (Proxy History, Repeater, Intruder, and Collaborator) and some extensions (Hackvertor and Piper).

Here is that talk:

You can download the slides here.

Challenges & Practice Labs

It goes without saying that the Web Security Academy by PortSwigger should be your go-to place to practice using Burp Suite.

You can also check out the free labs that PentesterLab publishes. Of course, some of the more fun labs require a subscription.

There are also some pretty fun CTFs that you should check out. I’ve already mentioned TryHackMe earlier. But another one of my favorites is the Hackthebox (HTB) platform. They have several labs/boxes related to Burp Suite.

OWASP Juice Shop is an awesome deliberately vulnerable web app that you can practice using Burp Suite on. If you don’t want to spin up your own instance of the web app, you can always launch the TryHackMe room for Juice Shop.

And don’t forget OWASP’s Completed Ridiculous API (crAPI) if you are into API hacking. APISec University hosts a demo version at crapi.apisec.ai. It’s a great place to learn how to use Burp Suite to hack an API.

Other Interesting Resources

Do you like cheat sheets? Of course you do. So make sure you download the SANS Burp Suite Cheat Sheet for a load of nice shortcuts and hotkeys to make you more efficient in the tool.

Like reading? Then you definitely want to download the Burp Suite Cookbook written by Sunny Wear. She’s incorporated many practical recipes to help you master security testing with Burp Suite.

Want to exfiltrate blind remote code execution output over DNS via Burp Collaborator? Then check out the Collabfiltrator GitHub repo.

Are you into mobile security testing? Then check out HackTricks Burp Suite Configuration for iOS to learn how to set up the Interception proxy on your iPhone/iPad. Oh, you’re into hacking Android instead? They have you covered there too with the Burp Suite Configuration for Android.

Final Thoughts

Learning Burp Suite doesn’t have to be frustrating, or expensive. By leveraging the tutorials and courses listed in this guide, you can get up to speed on the suite’s features quickly and for free. Whether you’re a beginner or an experienced security professional, there are plenty of resources here that will help you learn more about Burp Suite.

So, what are you waiting for? Get started today!

One last thing…

Is web app and API security testing important to you? Then subscribe to the FREE API Hacker Inner Circle newsletter and join thousands of other developers, testers, and hackers who want to level up their API hacking skills too.

Cya there!

The post The Ultimate Guide to Learning Burp Suite for FREE appeared first on Dana Epp’s Blog.

*** This is a Security Bloggers Network syndicated blog from Dana Epp's Blog authored by Dana Epp. Read the original post at: https://danaepp.com/the-ultimate-guide-to-learning-burp-suite-for-free

Original Post URL: https://securityboulevard.com/2023/07/the-ultimate-guide-to-learning-burp-suite-for-free/

Category & Tags: Security Bloggers Network,API Hacking Fundamentals – Security Bloggers Network,API Hacking Fundamentals