Archive for Dev. (junyup2)

์ง€์‹์„ ์ฑ„์›Œ๊ฐ€๋Š” ใ€Ž๊ฐœ๋ฐœ์ž/ํ™”์ดํŠธํ•ด์ปคใ€๋ฅผ ๋ชฉํ‘œ๋กœ ์ •๋ฆฌํ•˜๋Š” ๋ธ”๋กœ๊ทธ

๊ธฐํƒ€/์„ค์น˜·ํ™˜๊ฒฝ์„ค์ •

Burp Suite - ์„ค์น˜ ๋ฐ ์„ค์ •(์ˆ˜์ •์ค‘)

Gearvirus(junyup2) 2023. 11. 17. 19:50

Burp Suite - ๊ธฐ๋ณธ ์„ค์ •

 

 

์„ค์น˜ํ•˜๊ธฐ

 

์•„๋ž˜ ์‚ฌ์ดํŠธ ์ ‘์† -> ์ปค๋ฎค๋‹ˆํ‹ฐ ์—๋””์…˜ ๋‹ค์šด๋กœ๋“œ ๋ฐ ์„ค์น˜

(์ „๋ถ€ ๋‹ค์Œ, ํ™•์ธ ๋ˆ„๋ฅด๋ฉด์„œ ์„ค์น˜ํ•˜๋ฉด ๋จ)

https://portswigger.net/burp/communitydownload

 

Download Burp Suite Community Edition - PortSwigger

Burp Suite Community Edition is PortSwigger's essential manual toolkit for learning about web security testing. Free download.

portswigger.net

 

์‹œ์ž‘ํ•˜๊ธฐ

 

์•ฑ์„ ์‹คํ–‰ -> Next -> Start Burp

 

๊ธฐ๋ณธ ์„ธํŒ…

 

๋‹คํฌ๋ชจ๋“œ(with ํฐํŠธ ํฌ๊ธฐ) ์„ธํŒ…

  • ์„ค์ •(Setting)  -> ์œ ์ €(User) -> ์œ ์ € ์ธํ„ฐํŽ˜์ด์Šค(User interface) -> ๋””์Šคํ”Œ๋ ˆ์ด -> ๋‹คํฌ ํ…Œ๋งˆ / ํฐํŠธ ์‚ฌ์ด์ฆˆ

 

ํ•œ๊ตญ์–ด ํฐํŠธ ๊นจ์ง ํ˜„์ƒ ํ•ด๊ฒฐ

  • ์„ค์ •(Setting) -> ์œ ์ €(User) -> ์œ ์ € ์ธํ„ฐํŽ˜์ด์Šค(User interface) -> ์ธ์ŠคํŽ™ํ„ฐ & ๋ฉ”์‹œ์ง€ ์—๋””ํ„ฐ -> ํ•œ๊ตญ์–ด๋ฅผ ์ง€์›ํ•˜๋Š” ํฐํŠธ ์ข…๋ฅ˜๋กœ ๋ณ€๊ฒฝ

 

ํ”„๋ก์‹œ ์„ค์ • (Burp Suite)

 

  • ์„ค์ •(Setting) -> All -> Tools -> ํ”„๋ก์‹œ(Proxy) -> ํ”„๋ก์‹œ ๋ฆฌ์Šค๋„ˆ(Proxy Listener)

 

๋ฆฌ์Šค๋„ˆ ์„ธํŒ…

  • ๊ธฐ๋ณธ์„ธํŒ… : ํฌํŠธ 8080
  • ์ƒˆ๋กœ ์—ด์–ด์ค˜์•ผํ•˜๋Š” ๊ฒฝ์šฐ
    • Add -> Bind Port : (ํ•„์š”ํ•œ ํฌํŠธ๋กœ ์—ด์–ด์ค˜์•ผ ํ•จ)
    • Add ->  Adress
    • Loopback only : ๋‚ด ์ปดํ“จํ„ฐ์—์„œ๋งŒ ์‚ฌ์šฉ - localhost(127.0.0.1)
    • All interface : ๋‹ค๋ฅธ ์ปดํ“จํ„ฐ์—์„œ ์˜จ ๊ฒƒ์„ ํ•ด์„ํ•˜๋Š” ๊ฒฝ์šฐ ์‚ฌ์šฉ
    • Specific Adress : ํŠน์ • ์ฃผ์†Œ์— ๋Œ€ํ•˜์—ฌ(์‚ฌ์šฉํ•  IP ์ฃผ์†Œ ์ž…๋ ฅ)
ํ”„๋ก์‹œ ์„ค์ • (์ปดํ“จํ„ฐ)

 

ํฌํŠธ๋ฅผ ์„ค์ •ํ•˜๊ณ  ์—ด์–ด ์ค€ ๋’ค ๋ธŒ๋ผ์šฐ์ €์—์„œ ์‚ฌ์šฉํ•˜๊ธฐ ์œ„ํ•œ ์„ค์ •

 

  1. ๋„คํŠธ์›Œํฌ ์„ค์ •์—์„œ ์„ธํŒ…
    • ์„ค์ • -> ๋„คํŠธ์›Œํฌ ๋ฐ ์ธํ„ฐ๋„ท -> ํ”„๋ก์‹œ 
    • ์ˆ˜๋™ ํ”„๋ก์‹œ ์„ค์ • (ํ”„๋ก์‹œ ์„œ๋ฒ„ ์‚ฌ์šฉ)
    • ์ฃผ์†Œ : localhost(127.0.0.1)
    • ํฌํŠธ : ๊ธฐ๋ณธ์„ธํŒ…(8080)
  2. ์›ํ•˜๋Š” ๋ธŒ๋ผ์šฐ์ €์—์„œ ์„ธํŒ…
    • ex) Firefox