Skip to main content

Running Burp Suite outside of the Kali environment

infosec

Note: I am currently (May 2023) in the process of updating the image used in this article. Along the way I've run into to some issues that need resolving. This article shall reflect my findings and will be updated with any solutions I come across.

Introduction

Burp Suite, the swiss army knife and stable work horse of the pentester, gives web application developers a powerful suite to accomplish many common tasks. Even the free Community Edition contains plenty of goodness straight out of the box.

Options

While we may usually access Burp Suite through our Kali environment, we may like to have easier access to its tools on our default workstation as well. To accomplish this we have the following options to our disposal:

  • native install
  • Docker container
  • Kali through VM

Native install

We have to keep in mind that Burp suite is Java based, so will require Java to be available on the host system. Since I prefer to not have Java installed on my workstation I will forego this option. Install instructions: How to install Burp suite on Ubuntu 20.04 | 22.04 LTS

Docker container

We'll be using the following image:

Alternative versions:

Original version

For testing purposes, we'll start with running this outdated image. We'll clone the repo and cd into its directory:

git clone https://github.com/oda-alexandre/burpsuite.git && cd burpsuite

Next we edit the docker-compose.yaml file and make sure that it contains:

version: "2.0"

services:
  burpsuite:
    container_name: burpsuite
    image: alexandreoda/burpsuite
    restart: "no"
    privileged: false
    environment:
      - DISPLAY
    volumes:
      - "${HOME}:/home/burpsuite"
      - "/tmp/.X11-unix/:/tmp/.X11-unix/"
      - "/etc/localtime:/etc/localtime:ro"
    ports:
      - "8080:8080"

Build and run the container:

docker-compose up

Updated version

Currently testing the updated burpsuite-gogo image with the following Dockerfile:

FROM openjdk:19-slim

LABEL authors https://www.oda-alexandre.com

ENV USER burpsuite
ENV HOME /home/${USER}
ENV VERSION 2023.4.4
ENV PORTS 8080
ENV DEBIAN_FRONTEND noninteractive
ENV APP https://portswigger-cdn.net/burp/releases/download?product=community&version=${VERSION}&type=Jar

RUN echo -e '\033[36;1m ******* INSTALL PACKAGES ******** \033[0m' && \
  apt update && apt install --no-install-recommends -y \
  sudo \
  software-properties-common \
  fonts-dejavu \
  wget \
  openssl \
  libxext6 \
  libxrender1 \
  libxtst6 \
  libxi6 \
  font-manager \
  libfreetype6 \
  libasound2 \
  libnss3 \
  libnss3 \
  libnspr4 && \
  rm -rf /var/lib/apt/lists/*

RUN echo -e '\033[36;1m ******* ADD USER ******** \033[0m' && \
  useradd -d ${HOME} -m ${USER} && \
  passwd -d ${USER} && \
  adduser ${USER} sudo

RUN echo -e '\033[36;1m ******* SELECT USER ******** \033[0m'
USER ${USER}

RUN echo -e '\033[36;1m ******* SELECT WORKING SPACE ******** \033[0m'
WORKDIR ${HOME}

RUN echo -e '\033[36;1m ******* INSTALL APP ******** \033[0m' && \
  sudo mkdir /burp && \
  sudo chown -R ${USER}:${USER} /burp && \
  wget -q -O /burp/burpsuite.jar ${APP} && \
  mkdir -p ${HOME}/.java/.userPrefs/burp/ &&  \
  sudo apt-get --purge autoremove -y wget

RUN echo -e '\033[36;1m ******* ADD USER TO GROUP ******** \033[0m' && \
  sudo addgroup burp && \
  sudo adduser ${USER} burp

RUN echo -e '\033[36;1m ******* OPENING PORTS ******** \033[0m'
EXPOSE ${PORTS}

RUN echo -e '\033[36;1m ******* CONTAINER START COMMAND ******** \033[0m'
CMD java -jar /burp/burpsuite.jar
Fonts

Not sure if we even need this font, but the reference to the old font files were causing issues, so we updated them: Protonmail-bridge install fails with unmet dependencies ttf-dejavu

jre

We tried running this image from minidocks/java but were unable to. Burp Suite does seem to require a openjdk version of the Java Runtime Environment.

Burp Suite seems to run on openjdk.

  • openjdk This image contains a deprecation notice

According to this article, as of Dec 2022 Burp Suite requires Java 17 or later to run: Professional / Community 2022.12.4

Troubleshooting

Remember, as this Docker image runs the Burp Suite from the command line, we can tweak its invocation.

Updated version not receiving network traffic

We have not yet had much success getting network traffic to show up in the Burp Suite container. We should verify the following:

  • track network traffic using Wireshark (we can compare to mitmproxy which is receiving traffic in its container)
  • ensure that the image uses the right network (and network interface)
  • ensure that Burp Suite is configured correctly (we should ensure that our config is persistent and is loaded at start up)
    • tasks
    • proxy
    • watches for the correct traffic (or any traffic for that matter)
Embedded browser

Burp Suite comes with its own browser, which is ready to use for a variety of manual and automated testing purposes. Both of these images (original and updated) give us grief: we cannot run the embedded browser.

Issues we encountered: when running the healthcheck (Help > Embedded Browser health check) for the embedded browser, we received a number of error messages.

Missing dependencies

We installed these missing packages by adding them to the Dockerfile.

Sandbox issue

Following may be of use:

Resources