【TryHackMe】Burp Suite: The Basic：WalkThrough

# 概要

TryHackMe「Burp Suite: The Basic」ルームのwalkthroughです。

https://tryhackme.com/r/room/burpsuitebasics

# Task2

## **Q1**.*Which edition of Burp Suite runs on a server and provides constant scanning for target web apps?*

**A**.**Burp Suite Enterprise**

## **Q2**.*Burp Suite is frequently used when attacking web applications and ______ applications.*

**Hint**.*Fill in the blank.*

**A**.**mobile**

# Task3

## **Q1**.*Which Burp Suite feature allows us to intercept requests between ourselves and the target?*

`Proxt`タブの`Intercept`を`On`にすることで通信を取得できます。

![task3 q1.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/18b166fe-e9c2-9b5d-fc11-2f43ee43b807.png)

**A**.**proxy**

## **Q2**.*Which Burp tool would we use to brute-force a login form?*

リクエストを`Intruder`にセットすることでブルートフォースなどの様々な攻撃を行えます。

![task3 q2.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/2c0a765e-2842-0bc0-d3f1-1349d7255ad1.png)

**A**.**intruder**

# Task5

## **Q1**.*What menu provides information about the actions performed by Burp Suite, such as starting the proxy, and details about connections made through Burp?*

`Dashboard`タブの`Event log`項目からログを確認できます。

![task5 q1.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/8f9d3162-f219-8b5f-63b5-feb351c5d9b7.png)

**A**.**Event log**

# Task6

## **Q1**.*Which tab Ctrl + Shift + P will switch us to?*

**A**.**Proxy tab**

# Task7

## **Q1**.*In which category can you find a reference to a "Cookie jar"?*

`Proxy`タブから`Proxt settings`をクリックして設定画面を開きます。
`Sessions`の項目から`Cookie jar`の設定ができます。

![task7 q1.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/dbb4ce48-5b6e-8bca-6bc1-8abed4def4a0.png)

**A**.**Sessions**

## **Q2**.*In which base category can you find the "Updates" sub-category, which controls the Burp Suite update behaviour?*

**Hint**.*この質問に対する答えが「その他」の場合、Burp Suite の古いバージョンを使用しています。最新バージョンに更新してから、設定ウィンドウで答えを検索してください。*

Q1と同じく`Proxt settings`の画面から`Suite`->`updates`でアップデートの確認ができます。

![task7 q2.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/fec010f0-0c99-88f5-74ad-b89d343409b4.png)

**A**.**Suite**

## **Q3**.*What is the name of the sub-category which allows you to change the keybindings for shortcuts in Burp Suite?*

`User interface`->`Hotkeys`の画面からショートカットの編集ができます。

![task7 q3.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/ceb69383-45f0-b516-945c-5f5d170f0bb6.png)

**A**.**Hotkeys**

## **Q4**.*If we have uploaded Client-Side TLS certificates, can we override these on a per-project basis (yea/nay)?*

**Hint**.*Search for "Client TLS Certificates", then look at the scopes provided to the right of the section heading.*

`Network`->`TLS`の`Client TLS Certificates`項目から設定できます。

![task7 q4.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/251f258a-5374-fb27-0f05-0a3ca03ad4c1.png)

**A**.**yea**

# Task10

## **Q1**.*What is the flag you receive after visiting the unusual endpoint?*

**Hint**.*You are looking for a suspicious page with a name made up of a series of random letters and numbers.*

`/ticket`へアクセスすると`/assets/js/emailFilter.js`が読み込まれます。

![task10 q1 ticket access.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/a6095fe7-2150-4bf2-df07-27a6d4b1ab73.png)

`/assets/js/emailFilter.js`の中身を見てみると`/5yjR2GLcoGoij2ZK`というパスを読み込んでいます。

```/assets/js/emailFilter.js
window.addEventListener("load", () => {
    fetch("/5yjR2GLcoGoij2ZK")
    emailEl = document.querySelector('[name="email"]');
    ["keyup", "paste"].forEach(item => {
        emailEl.addEventListener(item, e => {
            emailEl.value = emailEl.value.replace(/[^A-Za-z0-9\.@-].*$/, "");
        });
    });
});
```

なので`/5yjR2GLcoGoij2ZK`へアクセスしてみると、フラグが表示されました。

![task10 q1.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/3967501e-308b-0a98-be20-6f8d8f45873c.png)

**A**.**THM{NmNlZTliNGE1MWU1ZTQzMzgzNmFiNWVk}**