Burp Suite Pro Service Mesh Setup

Burp Suite Service Mesh

Burp Suite Pro Service Mesh Istio Linkerd mTLS Intercept API Testing OWASP Scanner Intruder CI/CD DAST Production

Service Mesh Intercept

# === Burp Suite + Service Mesh Setup ===

# Method 1: Test Namespace (Recommended)
# Create namespace without mTLS for testing
# kubectl create namespace pentest
# kubectl label namespace pentest istio-injection=disabled
#
# # Deploy target service in pentest namespace
# kubectl apply -f deployment.yaml -n pentest
#
# # Port forward service
# kubectl port-forward svc/target-api 8080:80 -n pentest
#
# # Configure Burp Proxy: 127.0.0.1:8080 → target
# # Burp Proxy Listener: 127.0.0.1:8081
# # Browser/Client → Burp (8081) → Target (8080)

# Method 2: Envoy Sidecar Bypass
# kubectl exec -it pod/target-pod -c istio-proxy -- \
#   curl -x http://burp-host:8080 http://localhost:80/api/test
#
# # Or modify Envoy config to route through Burp
# apiVersion: networking.istio.io/v1alpha3
# kind: EnvoyFilter
# metadata:
#   name: burp-proxy
# spec:
#   workloadSelector:
#     labels:
#       app: target-api
#   configPatches:
#   - applyTo: CLUSTER
#     patch:
#       operation: ADD
#       value:
#         name: burp_proxy
#         type: STATIC
#         connect_timeout: 5s
#         load_assignment:
#           cluster_name: burp_proxy
#           endpoints:
#           - lb_endpoints:
#             - endpoint:
#                 address:
#                   socket_address:
#                     address: burp-host
#                     port_value: 8080

from dataclasses import dataclass

@dataclass
class InterceptMethod:
    method: str
    complexity: str
    mtls_handling: str
    best_for: str

methods = [
    InterceptMethod("Test Namespace (No mTLS)",
        "ง่าย",
        "ปิด Istio Injection ไม่มี mTLS",
        "General API Testing ทดสอบทั่วไป"),
    InterceptMethod("PERMISSIVE Mode",
        "ง่าย",
        "mTLS Optional ยอมรับ Plain HTTP",
        "Staging Environment Testing"),
    InterceptMethod("EnvoyFilter Proxy",
        "ซับซ้อน",
        "Route Traffic ผ่าน Burp ก่อน Envoy",
        "ทดสอบ Service-to-Service Traffic"),
    InterceptMethod("Burp CA in Trust Store",
        "ปานกลาง",
        "Import Burp CA ใน Pod Trust Store",
        "ทดสอบ mTLS Traffic โดยตรง"),
]

print("=== Intercept Methods ===")
for m in methods:
    print(f"  [{m.method}] Complexity: {m.complexity}")
    print(f"    mTLS: {m.mtls_handling}")
    print(f"    Best for: {m.best_for}")

API Security Testing

# === OWASP API Top 10 Testing with Burp ===

@dataclass
class APITest:
    vulnerability: str
    owasp_id: str
    burp_tool: str
    test_method: str
    severity: str

api_tests = [
    APITest("Broken Object Level Authorization",
        "API1:2023",
        "Repeater + Intruder",
        "เปลี่ยน ID ใน URL /api/orders/123 → /api/orders/456 ดูข้อมูลคนอื่น",
        "Critical"),
    APITest("Broken Authentication",
        "API2:2023",
        "Intruder + Scanner",
        "Brute-force Login Weak Token Test JWT None Algorithm",
        "Critical"),
    APITest("Broken Object Property Level Authorization",
        "API3:2023",
        "Repeater",
        "ส่ง Mass Assignment เช่น role=admin ใน Request Body",
        "High"),
    APITest("Unrestricted Resource Consumption",
        "API4:2023",
        "Intruder",
        "ส่ง Request จำนวนมาก ดู Rate Limiting ทำงานไหม",
        "Medium"),
    APITest("Broken Function Level Authorization",
        "API5:2023",
        "Repeater",
        "เรียก Admin Endpoint ด้วย User Token GET /api/admin/users",
        "Critical"),
    APITest("Server-Side Request Forgery (SSRF)",
        "API7:2023",
        "Repeater + Scanner",
        "ส่ง URL Internal เช่น http://169.254.169.254/metadata",
        "High"),
    APITest("Security Misconfiguration",
        "API8:2023",
        "Scanner",
        "ตรวจ CORS * Headers TLS Version Debug Endpoint",
        "Medium-High"),
]

print("=== OWASP API Top 10 Tests ===")
for t in api_tests:
    print(f"  [{t.owasp_id}] {t.vulnerability} | Severity: {t.severity}")
    print(f"    Tool: {t.burp_tool}")
    print(f"    Test: {t.test_method}")

CI/CD Integration

# === DAST in CI/CD Pipeline ===

# Jenkins Pipeline Example
# pipeline {
#   stages {
#     stage('Deploy to Staging') {
#       steps { sh 'kubectl apply -f k8s/ -n staging' }
#     }
#     stage('DAST Scan') {
#       steps {
#         sh '''
#           curl -X POST https://burp-enterprise/api/scan \
#             -H "Authorization: Bearer " \
#             -d '{"site_id": "staging-api", "scan_config": "quick"}'
#         '''
#         sh 'sleep 300'  // wait for scan
#         sh '''
#           RESULTS=$(curl https://burp-enterprise/api/scan/latest/issues)
#           CRITICAL=$(echo $RESULTS | jq '.issues[] | select(.severity=="high")' | wc -l)
#           if [ $CRITICAL -gt 0 ]; then exit 1; fi
#         '''
#       }
#     }
#   }
# }

@dataclass
class CICDConfig:
    stage: str
    trigger: str
    scan_type: str
    fail_criteria: str

pipeline = [
    CICDConfig("PR Check",
        "Every PR to main",
        "Quick Scan (5-10 min) Critical Only",
        "Any Critical → Block PR"),
    CICDConfig("Staging Deploy",
        "After merge to staging",
        "Standard Scan (30-60 min) High+Critical",
        "Critical → Block | High → Warning"),
    CICDConfig("Pre-Production",
        "Before production release",
        "Full Scan (2-4 hr) All Severities",
        "Critical/High → Block Release"),
    CICDConfig("Weekly Scheduled",
        "Every Sunday night",
        "Full Scan + Authenticated Scan",
        "Report → Jira Tickets Auto-create"),
]

print("=== CI/CD DAST Pipeline ===")
for c in pipeline:
    print(f"  [{c.stage}] Trigger: {c.trigger}")
    print(f"    Scan: {c.scan_type}")
    print(f"    Fail: {c.fail_criteria}")

เคล็ดลับ

• Test Namespace: สร้าง Namespace แยกปิด mTLS สำหรับ Pentest
• BOLA: ทดสอบ BOLA (เปลี่ยน ID) ทุก Endpoint ที่มี Resource ID
• Extensions: ใช้ Authorize Extension ทดสอบ Authorization อัตโนมัติ
• CI/CD: ใส่ DAST Scan ใน Pipeline Block Critical Issues
• Scope: กำหนด Target Scope ใน Burp ป้องกันสแกนนอก Scope

Burp Suite คืออะไร

Web Security Testing Tool PortSwigger Proxy Scanner Intruder Repeater Decoder Community Professional Enterprise OWASP BApp Extensions

สรุป

Burp Suite Pro Service Mesh Istio mTLS Intercept API OWASP Top 10 BOLA Scanner Intruder CI/CD DAST Pipeline Production Security