Burp Suite

The amount of guesses I have is the number of floors, you know, times the number of rooms per floor.

I can automate that guess or guessing process using Burp Suite and go through every single iteration, and the one that Pops up as yes, that's your room number.

There you go.

Through the Wi-Fi portal, I've identified where you are.

These professionals, often called white hat hackers, legally simulate cyber attacks to find weaknesses in the systems before malicious criminals do.

They operate with permissions and follow strict guidelines using the same tools as malicious hackers, such as Metasploit, Nmap, or Burp Suite, but with the goal of protecting rather than harming.

Ethical hacking plays a crucial role in proactive identification or vulnerabilities, which can prevent massive data leaks, financial losses, and reputational damage.

It's also essential for compliance with standards like PCI DSS or ISO twenty-seven thousand one, which often require regular security testing.

Makes sense.

Okay, so let's dive into this toolbox, shall we? First up, Burp Suite.

This one's a bit of a chameleon.

Ooh, how so?

You got it.

It's not just listening though.

Burp Suite can actually manipulate that communication.

Manipulate.

It's going to work on, on the same situations where.

a human with a copy of Burp Suite Pro would also work.

And it's probably not going to work as well on those situations that really call for, you know, an advanced participant threat model who's going to sit there and pick away and dwell and all of those things.

You're going to see in the next several months, I'm sure, and I've talked to people at IR, we have our own IR team, like you're going to see a bunch of like, hey, they used AI to breach this company and do like traditional ransomware attack.

And it basically just kind of rolls through like that.

It's all sits on its own Kali VM.

Everything, you know, it's supposed to be pushing everything into using again, the little Go server to make requests that then go through Burp Suite.

So it all gets logged.

In this interview, we're going to be talking about Burp AT.

That is the agentic way to drive the well-known and very popular Burp Suite pen testing tool.

Burp AT was in beta for a while.

It's now out of, out of beta, and it was released in, at, uh, at Black Hat.

Is it a harness? Can I connect it to other things? Do I bring my own LLMs? So we started off there.

We started off by getting a grounding in what exactly is Burp AT, how does it work, what is it, what is it not? And then Kieran and Andrzej talked me through some of the things that they learned while it was in beta, some of the interesting stories that they've had from customers about how they've been able to use Burp AT.

But then we zoom out also to ask, so what? What does it mean to have an autonomous mode for such a well-established pen testing tool? What does this mean for the industry? So I'll drop you here into the interview where Kieran starts off by giving us an introduction to exactly what Burp AT is and how it sits on top of Burp Suite.

Enjoy.

It should just proxy the request back and forth.

Uh, and then I took a look at the, uh, Burp Suite, uh, like the HTTP proxy-

Mm-hmm

... request that's actually sent from access-leaks.dev and example.com, uh, and they looked identical except for one single header.

Cody, I wanted to get back for a second to your catchphrases, because I have a number of different questions here.

Uh, the Burp Suite.

Yeah.

Uh, I'd like you to explain that to the audience and Trista.

The Burp Suite, uh, you have four different words-

Right

...

in one category in your top 10, correct?