Hey there, welcome back. In the last module
and in this module, we've spent a lot of time
on injection attacks. We're continuing to address injection attacks in this module, starting with this lesson. Here we'll be using
a proxy to intercept the traffic from
the client to the server. Also introduce you to using
a proxy tool called Burp, and it simply provides
a mean for us to man-in-the-middle
our application. If you don't know what that means or what a man-in-the-middle is, don't worry about it,
we'll get into it. After this lesson,
you'll be able to describe what a
man-in-the-middle attack is, using the Burp Suite proxy to man-in-the-middle
your traffic, and finally modify that traffic as it's on its way
back to the server. Now we're doing everything
on one machine, but there's no reason that WebGoat can't be on
its own machine, the user's browser on
a separate machine, and our proxy tool
that's intercepting the traffic on
an independent machine. Keep that in mind
as we go through this course, let's get started. Hey everyone. In this video
we're going talk about using a proxy to intercept the traffic going from
our clients to our servers. If you're coming from
a development background, you've probably used
a tool like Fiddler to intercept traffic between
your server and your client. If you're coming from
a security background, you've probably heard of
OWASP open source tool called ZAP or Burp Suite
scanners by PortSwigger. Both are great tools, you're more than welcome
to use any of them. There's actually other tools too, there is a terminal based
app if you like to do things at the terminal called mitmproxy. But for this tutorial and for the remainder
of this course, I'm going to be using Burp, simply because I'm used
to it not because it has any distinct advantages
among the other ones, especially because I'm
using the community version which is free. But again, feel free to use whatever tool
you're going to use. In this video, I'm going to
talk to you about how to set up this proxy. So if you already are
familiar with how to set up these proxies and some of
the gotchas around them, feel free to skip
through this video. Otherwise, let's get
started with that. So I'm going to launch Burp, and one thing I want to
note is that I have already stopped WebGoat and I'll talk about why I've
already stopped it. But make sure WebGoat stopped
before you start Burp. I'm going to not load any
projects and I'm going to use a defaults Burp configuration
just to show you. So if you go to proxy
and then options, you'll notice Burp automatically starts listening on port 8080. Now, that's the same
port as WebGoat. So the conflict causes issues and that's primarily why I
disable WebGoat when I start. Half the times when
I have WebGoat running and if I start
Burp on top of it, it creates some inconsistencies between the connection
states on my machine. So I've just learned to always
turn off WebGoat first. So I'm going to uncheck
this box to disable it. Hit Edit and change the ports, we're going to use 8011, just a random high number ports, and we can see if
that's a open port. So I'm going to hit Okay on this. I'm going to re-enable it. Now, if you go to the alerts
tab, you'll notice that, let me stress this
open a little bit, you'll notice that you automatically got
started on port 8080. We obviously stopped it
by unchecking the box, and then we restarted
on port 8080. Since I don't see
any other messages here, I'm going to assume that means it was successful
starting listening. If the port was taken
for some reason, you would have seen errors here that the port has been taken. I'm going to go back to the proxy and I'm going to go onto
the intercepts page, and I'm going to turn
interception off. So the idea behind this is, it allows you to look
at the traffic and modify it before it allows it to go from the client to the server or from
the server to the client. Now, that'll get a little
noisy and difficult, so we're going to turn that off and just let it go through. There might be some instances
where we use that feature, but we can get around having
to use it because it does really slow things down without proper configuration. All right. Then I'm just going to click on the HTTP history tab so that
we can look at that history. For my browser, I'm
going to use Firefox. Both Chrome, Chromium,
and Safari on a Mac use this
system proxy settings. I don't really want to change my system proxy settings
because I have a lot of other apps that are
running on my machine that call back to their servers, and making it go through this proxy will
both slow it down, it'll add a bunch of noise here, and it actually throws
a lot of errors for the ones that have
certificate error, simply because doing a man-in-the-middle attack
which is what our proxy is essentially doing,
it's a man-in-the-middle, will break some of
those HTTPS certificates that were used to and it just
creates a whole lot of issues. So I'm using Firefox
because Firefox allows us to have a browser
specific setting. So in Firefox, if you go to preferences and
simply search proxy, the settings button
that comes up under network settings allows you
to not have a proxy at all, auto-detected for the network uses system proxy
which is the Mac one, obviously I don't
want to change that. So we'll manually configure one. So I'm going to manually
configure one on port 8011 for my local host, you can use any port that's open. I'm going to keep
it as a SOCKS v4, I'm not going to put
any exceptions here just because I'm using my Firefox browser
only for this purpose, and I'm going to go
ahead and hit Okay. Next, I'll launch WebGoat. Just like normal, there's
nothing different about my WebGoat
instance currently, and give it a quick
second to load up. All right. So after refreshing, you'll notice that this is our normal WebGoat and you can also see all of the traffic that's
going back and forth. In fact, you can also look at and look at the actual traffic that's going back and forth, and the very first
call that I made against WebGoat
contains my session ID. So I can modify this session ID if I knew another
user's session ID, and essentially impersonate them. I can change some
of these settings, some of the configuration,
what's being posted. In fact one of the most fun
thing to do is to login. Since there is no HTTPS
in scope for this, where is my post method? There is a post method for login and you can
see my username, and you can see
my very secure password. All right. I hope
you enjoyed that. Again, if you want to use
a different tool feel free, I only use Burp just because
I'm comfortable with it.