It is listed on the site under the ‘Deliberately Vulnerable’ -> ‘Web Apps’ navbar option, and it is called (drumroll….) ‘Juice Shop’. For the purposes of the rest of this series the specific section of attackdefense that we will use is the OWASP Juice Shop Vulnerable Web Application (see pun from previous paragraph). At the time I’m writing this, the site is free to use, and all you need is a Google account. The best and easiest way to get started with practicing web hacking (that I have found) is to use. Input the Burp Suite Proxy listener address which has the default 127.0.0.1 into the HTTP Proxy field. From the connection settings section, select the Manual proxy configuration. All of this is just the beginning of what will eventually lead to a mastery of Burp Suite, so now is a good time to be excited. Click on the General menu and go to the Network Settings section and click the Settings button.

(You’ll understand that pun in a second). Maybe even squeeze some “Juice” out of it. After that, we will take a look at scoping our testing and using Burp’s built in crawl and scan tools to try and find some low hanging fruit. To start, we need to set up a good practice target. This part in the series is going to go over some basic uses of Burp to get you on the road to your first finding. Thankfully, there are many apps to test with online that are free to use in a safe environment.

But where do we start? Well, I don’t recommend hitting the open information highway and testing whatever you see. Now it’s time to hit the web and hack some apps. So you made it through Part 1? Congrats on your success – that was the most boring part.

Burp suite pro scanner tutorial