0: Getting Started with Burp Suite - Gin and Juice Shop (Portswigger)

Intro / Setup for new web pentesting series (ft. burp suite crash course) - Episode 1 of hacking the Gin and Juice shop; an intentionally vulnerable web application developed by Portswigger. The website was created primarily to demonstrate the features of Burp pro vulnerability scanner. However, throughout the series, we will leverage burp suite (and other tools) to exploit the high, medium, low and informational issues identified by the scanner. Hopefully these videos will be useful for aspiring bug bounty hunters, security researchers, pentesters, CTF players etc 🙂 #BugBounty #EthicalHacking #PenTesting #AppSec #WebSec #InfoSec #OffSec

↢Social Media↣
Twitter:   / _cryptocat  
GitHub: https://github.com/Crypto-Cat/CTF
HackTheBox: https://app.hackthebox.eu/profile/11897
LinkedIn:   / cryptocat  
Reddit:   / _cryptocat23  
YouTube:    / cryptocat23  
Twitch:   / cryptocat23  

↢Portswigger: Gin and Juice Shop↣
https://ginandjuice.shop
https://portswigger.net/blog/gin-and-...
https://portswigger.net/burp/vulnerab...
https://portswigger.net/web-security

↢Resources↣
Ghidra: https://ghidra-sre.org/CheatSheet.html
Volatility: https://github.com/volatilityfoundati...
PwnTools: https://github.com/Gallopsled/pwntool...
CyberChef: https://gchq.github.io/CyberChef
DCode: https://www.dcode.fr/en
HackTricks: https://book.hacktricks.xyz/pentestin...
CTF Tools: https://github.com/apsdehal/awesome-ctf
Forensics: https://cugu.github.io/awesome-forensics
Decompile Code: https://www.decompiler.com
Run Code: https://tio.run

↢Chapters↣
0:00 Intro
0:33 Gin & Juice Shop
0:53 Burp Suite Crash Course (~5 mins)
1:06 Burp: What is it?
1:18 Burp: Setup/FoxyProxy
2:00 Burp: Interceptor
2:25 Burp: HTTP History
2:37 Burp: Repeater
3:31 Burp: Intruder
4:29 Burp: Sequencer
4:45 Burp: Collaborator
5:08 Burp: Decoder
5:15 Burp: Comparer
5:18 Burp: Logger
5:23 Burp: Extensions
5:43 Burp: Site map (target)
5:53 Burp: Spider (crawler)
6:00 Burp: Scanner
6:28 Burp: Scope
7:37 Burp: Crawl and Audit (authenticated)
9:42 Burp: Live audit (scoped)
10:51 Explore website functionality
11:18 Waiting for vulnerability scanner
11:40 Review scan results
12:35 Try to catch more issues
14:37 Generate report
15:39 Review high/med/low/info issues
16:58 Regenerate report
17:53 Conclusion