Burp Suite Pro Service Mesh Setup — ทดสอบ

Burp Suite Service Mesh

Burp Suite Pro Service Mesh Istio Linkerd mTLS Intercept API Testing OWASP Scanner Intruder CI/CD DAST Production

เนื้อหาเกี่ยวข้อง — อ่านต่อ: collision domain คือ — คู่มือฉบับสมบูรณ์ 2026

Feature	Community (Free)	Professional ($449/yr)	Enterprise
Proxy	มี	มี	มี
Scanner	ไม่มี	มี (Full)	มี (Auto CI/CD)
Intruder	จำกัด (ช้า)	มี (Full Speed)	มี
Repeater	มี	มี	มี
Extensions	มี	มี	มี
CI/CD	ไม่มี	CLI Only	Full API

Service Mesh Intercept

# === Burp Suite + Service Mesh Setup ===



# Method 1: Test Namespace (Recommended)

# Create namespace without mTLS for testing

# kubectl create namespace pentest

# kubectl label namespace pentest istio-injection=disabled

#

# # Deploy target service in pentest namespace

# kubectl apply -f deployment.yaml -n pentest

#

# # Port forward service

# kubectl port-forward svc/target-api 8080:80 -n pentest

#

# # Configure Burp Proxy: 127.0.0.1:8080 → target

# # Burp Proxy Listener: 127.0.0.1:8081

# # Browser/Client → Burp (8081) → Target (8080)



# Method 2: Envoy Sidecar Bypass

# kubectl exec -it pod/target-pod -c istio-proxy -- \

#   curl -x http://burp-host:8080 http://localhost:80/api/test

#

# # Or modify Envoy config to route through Burp

# apiVersion: networking.istio.io/v1alpha3

# kind: EnvoyFilter

# metadata:

#   name: burp-proxy

# spec:

#   workloadSelector:

#     labels:

#       app: target-api

#   configPatches:

#   - applyTo: CLUSTER

#     patch:

#       operation: ADD

#       value:

#         name: burp_proxy

#         type: STATIC

#         connect_timeout: 5s

#         load_assignment:

#           cluster_name: burp_proxy

#           endpoints:

#           - lb_endpoints:

#             - endpoint:

#                 address:

#                   socket_address:

#                     address: burp-host

#                     port_value: 8080



from dataclasses import dataclass



@dataclass

class InterceptMethod:

    method: str

    complexity: str

    mtls_handling: str

    best_for: str



methods = [

    InterceptMethod("Test Namespace (No mTLS)",

        "ง่าย",

        "ปิด Istio Injection ไม่มี mTLS",

        "General API Testing ทดสอบทั่วไป"),

    InterceptMethod("PERMISSIVE Mode",

        "ง่าย",

        "mTLS Optional ยอมรับ Plain HTTP",

        "Staging Environment Testing"),

    InterceptMethod("EnvoyFilter Proxy",

        "ซับซ้อน",

        "Route Traffic ผ่าน Burp ก่อน Envoy",

        "ทดสอบ Service-to-Service Traffic"),

    InterceptMethod("Burp CA in Trust Store",

        "ปานกลาง",

        "Import Burp CA ใน Pod Trust Store",

        "ทดสอบ mTLS Traffic โดยตรง"),

]



print("=== Intercept Methods ===")

for m in methods:

    print(f"  [{m.method}] Complexity: {m.complexity}")

    print(f"    mTLS: {m.mtls_handling}")

    print(f"    Best for: {m.best_for}")

API Security Testing

# === OWASP API Top 10 Testing with Burp ===



@dataclass

class APITest:

    vulnerability: str

    owasp_id: str

    burp_tool: str

    test_method: str

    severity: str



api_tests = [

    APITest("Broken Object Level Authorization",

        "API1:2023",

        "Repeater + Intruder",

        "เปลี่ยน ID ใน URL /api/orders/123 → /api/orders/456 ดูข้อมูลคนอื่น",

        "Critical"),

    APITest("Broken Authentication",

        "API2:2023",

        "Intruder + Scanner",

        "Brute-force Login Weak Token Test JWT None Algorithm",

        "Critical"),

    APITest("Broken Object Property Level Authorization",

        "API3:2023",

        "Repeater",

        "ส่ง Mass Assignment เช่น role=admin ใน Request Body",

        "High"),

    APITest("Unrestricted Resource Consumption",

        "API4:2023",

        "Intruder",

        "ส่ง Request จำนวนมาก ดู Rate Limiting ทำงานไหม",

        "Medium"),

    APITest("Broken Function Level Authorization",

        "API5:2023",

        "Repeater",

        "เรียก Admin Endpoint ด้วย User Token GET /api/admin/users",

        "Critical"),

    APITest("Server-Side Request Forgery (SSRF)",

        "API7:2023",

        "Repeater + Scanner",

        "ส่ง URL Internal เช่น http://169.254.169.254/metadata",

        "High"),

    APITest("Security Misconfiguration",

        "API8:2023",

        "Scanner",

        "ตรวจ CORS * Headers TLS Version Debug Endpoint",

        "Medium-High"),

]



print("=== OWASP API Top 10 Tests ===")

for t in api_tests:

    print(f"  [{t.owasp_id}] {t.vulnerability} | Severity: {t.severity}")

    print(f"    Tool: {t.burp_tool}")

    print(f"    Test: {t.test_method}")

CI/CD Integration

# === DAST in CI/CD Pipeline ===



# Jenkins Pipeline Example

# pipeline {

#   stages {

#     stage('Deploy to Staging') {

#       steps { sh 'kubectl apply -f k8s/ -n staging' }

#     }

#     stage('DAST Scan') {

#       steps {

#         sh '''

#           curl -X POST https://burp-enterprise/api/scan \

#             -H "Authorization: Bearer " \

#             -d '{"site_id": "staging-api", "scan_config": "quick"}'

#         '''

#         sh 'sleep 300'  // wait for scan

#         sh '''

#           RESULTS=$(curl https://burp-enterprise/api/scan/latest/issues)

#           CRITICAL=$(echo $RESULTS | jq '.issues[] | select(.severity=="high")' | wc -l)

#           if [ $CRITICAL -gt 0 ]; then exit 1; fi

#         '''

#       }

#     }

#   }

# }



@dataclass

class CICDConfig:

    stage: str

    trigger: str

    scan_type: str

    fail_criteria: str



pipeline = [

    CICDConfig("PR Check",

        "Every PR to main",

        "Quick Scan (5-10 min) Critical Only",

        "Any Critical → Block PR"),

    CICDConfig("Staging Deploy",

        "After merge to staging",

        "Standard Scan (30-60 min) High+Critical",

        "Critical → Block | High → Warning"),

    CICDConfig("Pre-Production",

        "Before production release",

        "Full Scan (2-4 hr) All Severities",

        "Critical/High → Block Release"),

    CICDConfig("Weekly Scheduled",

        "Every Sunday night",

        "Full Scan + Authenticated Scan",

        "Report → Jira Tickets Auto-create"),

]



print("=== CI/CD DAST Pipeline ===")

for c in pipeline:

    print(f"  [{c.stage}] Trigger: {c.trigger}")

    print(f"    Scan: {c.scan_type}")

    print(f"    Fail: {c.fail_criteria}")

เคล็ดลับ

Test Namespace: สร้าง Namespace แยกปิด mTLS สำหรับ Pentest
BOLA: ทดสอบ BOLA (เปลี่ยน ID) ทุก Endpoint ที่มี Resource ID
Extensions: ใช้ Authorize Extension ทดสอบ Authorization อัตโนมัติ
CI/CD: ใส่ DAST Scan ใน Pipeline Block Critical Issues
Scope: กำหนด Target Scope ใน Burp ป้องกันสแกนนอก Scope

Burp Suite คืออะไร

Web Security Testing Tool PortSwigger Proxy Scanner Intruder Repeater Decoder Community Professional Enterprise OWASP BApp Extensions

แนะนำเพิ่มเติม — แหล่งความรู้ Forex iCafeForex

เนื้อหาเกี่ยวข้อง — แนะนำให้อ่าน LLM Fine-tuning LoRA Incident Management

เนื้อหาเกี่ยวข้อง — แนะนำให้อ่าน LangChain Agent Observability Stack