Recon &
Web Proxies
Before any hacker attacks a system, they first gather information quietly. Using tools like web proxies, they can see and manipulate every request your browser sends without you noticing.
What You'll Learn
By the end of this workshop, you'll be able to perform reconnaissance, intercept live traffic, and manipulate HTTP requests like a pro.
Core Concepts
Two foundational ideas underpin this entire workshop. Understand these deeply before moving on.
What exactly are we looking for?
During recon, a security tester tries to build a complete picture of the target without triggering alarms. Think of it like a burglar walking past a house multiple times before deciding how to enter.
- Endpoints - URLs the app responds to (e.g.,
/api/users,/admin/panel) - Parameters - Query strings or POST fields (
?id=42,username=admin) - Technologies - What framework, server, or CMS is running (revealed by headers, cookies, HTML comments)
- Hidden pages - Directories not linked publicly, often found via fuzzing tools
like
gobusterorffuf
Passive vs Active Recon
Passive recon involves looking at publicly available info like Google, Shodan, or
WHOIS without ever touching the target server.
Active recon means directly probing
the target, which generates logs and can be detected.
How does a proxy sit in the middle?
Normally: Browser → Server. With a proxy: Browser → Burp Suite → Server.
The browser is configured to send all traffic through Burp running on 127.0.0.1:8080.
What can you actually do with it?
- Read every HTTP request and response in plain text
- Edit headers, cookies, POST body, URL parameters before forwarding
- Replay requests as many times as you want
- Automate fuzzing via the Intruder tool
- Scan for vulnerabilities with the active scanner (Burp Pro)
What about HTTPS?
Burp Suite acts as a SSL/TLS terminator - it decrypts the traffic, lets you read or edit it, then re-encrypts before forwarding. This requires installing Burp's CA certificate in your browser so it trusts Burp as a valid authority.
The 5-Step Process
Every web proxy engagement follows this repeatable workflow. Master it and you'll apply it to any target.
- Identify website structure - page hierarchy, navigation, forms
- Discover endpoints - URLs the app exposes (APIs, admin paths)
- Collect information - tech stack, server headers, cookies
Browser DevTools
Press F12 -> Network tab. Every request and response is logged here. Look at headers
for server software (Server: nginx/1.18), response codes, and cookies.
Gobuster / FFUF
These tools brute-force directories using wordlists. Example:
gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt
Wappalyzer
A browser extension that fingerprints the tech stack automatically - reveals CMS, frameworks, analytics tools.
- Install Burp Suite Community Edition (free) from portswigger.net
- Set browser proxy to 127.0.0.1:8080 (Manual HTTP proxy)
- Enable interception - navigate to Proxy -> Intercept -> Intercept is ON
In Firefox:
- Settings -> Network Settings -> Manual proxy configuration
- HTTP Proxy:
127.0.0.1, Port:8080 - Check "Use this proxy for all protocols"
Install Burp CA Certificate (for HTTPS):
- With Burp running, browse to
http://burpin Firefox - Click "CA Certificate" to download it
- Firefox -> Settings -> View Certificates -> Import
- Check "Trust this CA to identify websites"
Tip: Use Burp's built-in browser
Burp Pro/Community ships with a Chromium browser that's pre-configured. Go to
Proxy -> Open Browser - no manual setup needed.
- Capture HTTP requests as they leave the browser
- View all headers - User-Agent, Cookie, Referer, Authorization
- View parameters - URL query strings and POST body data
HTTP Request Structure
- Request line:
POST /login HTTP/1.1- method, path, version - Headers: Key-value pairs like
Cookie: session=abc123 - Body: For POST requests, the actual form data:
username=admin&password=1234
Key headers to watch
Cookie- session tokens; tampering here can hijack sessionsAuthorization- Bearer tokens for APIsX-Forwarded-For- sometimes used for IP-based access controlReferer- some apps use this to verify you came from a legitimate page
- Edit any parameter - change
role=usertorole=admin - Replay the modified request using Burp's Repeater tab
Parameter tampering
Change ?id=5 to ?id=1 to access another user's data (IDOR vulnerability).
Change price=99.99 to price=0.01 in a shopping cart request.
Cookie manipulation
If a cookie contains isAdmin=false, change it to isAdmin=true. Many
poorly built apps trust cookie values directly.
Header injection
Add X-Forwarded-For: 127.0.0.1 to trick an app into thinking you're on localhost.
Burp Repeater
Right-click any request -> Send to Repeater (Ctrl+R). Now you can edit and resend it
endlessly without re-navigating in the browser.
- Look for error messages that reveal backend info (stack traces, SQL errors)
- Test inputs with payloads and observe application behavior safely in the lab
- Check if privilege escalation is possible by changing roles or IDs
IDOR (Insecure Direct Object Reference)
Accessing resources you shouldn't by changing an ID. e.g., /api/orders/1337 revealing
another user's order.
Broken Authentication
Weak session tokens, no rate limiting on login, or session tokens not invalidated on logout.
Missing Access Controls
A non-admin can hit /admin/deleteUser just by guessing the URL. The server doesn't
verify your role.
Information Disclosure
Error pages exposing server paths, internal IPs, database structure, or stack traces.
Common Pitfalls
When something doesn't work, check these first - in order.
Test Your Knowledge
Answer these questions to confirm you've grasped the core concepts before tackling the challenge.
username=alice&password=hunter2. What Burp Suite feature would you use
to replay this request repeatedly with different password values?Now Do It Yourself
Apply everything you've learned. This is the hands-on task you need to complete to finish the workshop.
Further Resources
You've completed the workshop. Here's where to go next to level up your skills.
OWASP Web Security Testing Guide
Official, detailed methodologies for testing web application security, including reconnaissance techniques and proxy usage. The definitive reference for professional web pentesters.
Burp Suite Documentation
Official guide covering all Burp Suite features: proxy, intercept, repeater, intruder, scanner, and request analysis. Start here for any Burp-specific questions.
PortSwigger Web Security Academy
Free, interactive labs with real-world vulnerability scenarios - SQL injection, XSS, CSRF, IDOR, and more. Hands-down the best free platform to practice web security skills.