How to Use Burp & FoxyProxy to Easily Switch Between Proxy Settings « Null Byte :: WonderHowTo

One of the best ways todig into a websiteand look for vulnerabilities is by using aproxy. By routing traffic through a proxy like Burp Suite, you can discover hidden flaws quickly, but sometimes it's a pain to turn it on and off manually. Luckily, there is abrowseradd-on calledFoxyProxythat automates this process with a single click of a button.Why Use a Proxy Switcher?A proxy switcher is a tool, usually in the form of a browser add-on, that allows one to turn a proxy on and off or cycle between multiple proxies with the click of a button. It saves loads of time as it usually takes many clicks to enable or disable a proxy.It is beneficial forsecurity researchers and penetration testersbecause the time saved messing around with settings can be put to better use, especially when exploring a website for testing. It can get annoying having to turn the proxy on and off constantly, but the use of a proxy switcher makes the process trivial.Don't Miss:Generate a Clickjacking Attack with Burp Suite to Steal User ClicksFoxyProxy is a popular proxy switcher available for bothFirefoxandGoogle Chrome. Here, we will be installing and configuring FoxyProxy in Firefox to use in conjunction with Burp Suite.Step 1: Add FoxyProxy to FirefoxThe first thing we need to do is start Firefox and navigate to the Add-ons Manager. You can do so by using theCtrl Shift pshortcut, clicking the "Open menu" button in the toolbar then "Add-ons," or hitting "Tools" in the menu bar followed by "Add-ons."Click "Find more add-ons" on thePersonalize Your Firefoxpage for "Get Add-ons," and search for FoxyProxy.We will use FoxyProxy Basic as it offers enough functionality for what we need. Alternatively, instead of going through all of the above steps, you can just godirectly to FoxyProxy Basic's extension page.We can then click "Add to Firefox" to add the extension.Make sure to hit "Add" on the prompt to allow access to what it needs.We will then be directed to FoxyProxy's page, which includes a changelog and a bit more information.Step 2: Add a Custom ProxyThere should now be a little icon in the upper-right area of the browser, next to bookmarks or whatever else is in the toolbar. Click the icon and select "Options" to go to the settings page.Next, click "Add" to add a custom proxy.With Burp Suite up and running, go to the "Options" tab under "Proxy." We just want to confirm the defaultIP address and portsince it needs to match in FoxyProxy.Now we can fill in the information and give it a title to keep things organized.Click "Save," and our proxy should now appear on the main settings page.Now, all we have to do is enable it while Burp is running, allowing us to effortlessly switch the proxy on and off or even switch between different proxies. Click the icon and select "Use proxy Burp for all URLs (ignore patterns)" to turn it on.Step 3: Add the Burp CA (If Not Already Done)Now if we navigate to a website, we will receive an insecure connection warning.We could make an exception each time we load a new page, but this would get annoying fast. Instead, we can add Burp'scertificateto our browser, so it remains a trusted authority. To do this, navigate to the interface Burp is running on in the browser.Click on "CA Certificate," and save the file.Next, go to "Preferences," and scroll all the way to the bottom on the "Privacy & Security" page.Click "View Certificates," and hit the "Import" button.Now we can select the certificate file we just downloaded.A prompt will open asking if we want to trust a new Certificate Authority. Select "Trust this CA to identify websites" and hit "OK" to save.Now if we view our certificates, we will find the PortSwigger (the company that makes Burp Suite) certificate is installed.Step 4: Test the Custom ProxyIf we send a request through Burp now, it should be successful.Step 5: Fix SSL Errors (If Necessary)One error that may arise is related toSSLrecords.I found the easiest fix for this was to simply downgrade theTLS version from 1.3 to 1.2. Note: do this at your own risk — TLS 1.2 is still widely used and relatively secure, but know that you won't be running the most recent version in your browser.Navigate to the "about:config" page in the browser, and click "I accept the risk!" to continue.Search for "security.tls" and double-click on "security.tls.version.max" to change the settings.Change the value to "3" to downgrade to TLS 1.2. Yes, I know, this is sort of confusing, but it is what it is.Step 6: Test the Custom Proxy AgainNow, when we visit a website and send the request through Burp, it completes successfully, and we don't get any more errors.When we are done, or if we want to disable the proxy temporarily, click the FoxyProxy icon again, and select "Turn Off FoxyProxy (Use Firefox Setting)" to return to the default settings for Firefox.Wrapping UpWe learned about proxy switchers and what the advantages of using them are. We installed and configured a browser add-on called FoxyProxy that allowed us to turn a proxy, like Burp Suite, on and off with a single click. We also covered some configuration issues, including setting the Certificate Authority and getting Burp to work with TLS. Now that FoxyProxy is installed, more time can be spent finding bugs and not messing with settings.Don't Miss:Attack Web Applications with Burp Suite & SQL InjectionWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image bygeralt/Pixabay; Screenshots by drd_/Null ByteRelatedHow To:Hack Facebook & Gmail Accounts Owned by MacOS TargetsHow To:Generate a Clickjacking Attack with Burp Suite to Steal User ClicksHack Like a Pro:How to Crack Online Web Form Passwords with THC-Hydra & Burp SuiteHow To:Leverage a Directory Traversal Vulnerability into Code ExecutionHow To:Bypass File Upload Restrictions Using Burp SuiteHow To:Discover XSS Security Flaws by Fuzzing with Burp Suite, Wfuzz & XSStrikeHack Like a Pro:How to Hack Web Apps, Part 4 (Hacking Form Authentication with Burp Suite)Hack Like a Pro:How to Hack Web Apps, Part 3 (Web-Based Authentication)How To:Hack SAML Single Sign-on with Burp SuiteHacking Windows 10:How to Hack uTorrent Clients & Backdoor the Operating SystemHow To:Add Proxies to Your ProxyChains Config File the Lazy Way ;)How To:Bypass School Internet Filters to Unblock WebsitesHow To:Hide Your IP Address with a Proxy ServerHow To:Use Charles Proxy to View the Data Your Mobile Apps Send & ReceiveHow To:Correctly burp a babyHow To:Use a proxy with Firefox to hide your IP addressSPLOIT:How to Make a Proxy Server in PythonThe Hacks of Mr. Robot:How Elliot & Fsociety Made Their Hack of Evil Corp UntraceableHow To:Chain Proxies to Mask Your IP Address and Remain Anonymous on the WebHow To:Sneak Past Web Filters and Proxy Blockers with Google TranslateHow To:Use Tortunnel to Quickly Encrypt Internet TrafficNews:Play BF3 Today! (1 day early)Anonymous Browsing in a Click:Add a Tor Toggle Button to ChromeHow To:Quickly Encrypt Your Web Browsing Traffic When Connected to Public WiFiHow To:Bypass DansGuardian in Chrome, Firefox & Internet ExplorerHow To:Block Unwanted Ads on an iPad/iPhone—No Jailbreak RequiredHow To:Bypass a Local Network Proxy for Free InternetTor vs. I2P:The Great Onion Debate