+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Brute Force Attack With Burp (/Thread-Brute-Force-Attack-With-Burp)
Brute Force Attack With Burp - freya - 12-22-2012
In many occasions as a penetration testers we will have to face a web application where it will contain a login form which we will have to test it for weak credentials.Burp Suite is probably the best tool to be used when assessing web applications.Burp’s main use is to be a proxy interceptor,however provides a lot of other functions to penetration testers and it can also be used to attack a login form.In this article we will examine how we can use Burp in order to perform a brute force attack on a web application.
Let’s say that we have the following login form:
![[Image: bruteforce.jpeg]](http://pentestlab.files.wordpress.com/2012/12/bruteforce.jpeg)
Login Form
We will try to submit a username and a password and we will use the Burp Suite in order to capture the HTTP request.
![[Image: bruteforce1.jpeg]](http://pentestlab.files.wordpress.com/2012/12/bruteforce1.jpeg)
Capturing the HTTP Request
Then we will send the request to the Intruder (Action—>Send to Intruder) and we will clear the positions on the request that we will not need to insert payloads which are the $low$ and session cookie.So we will leave the following positions:
![[Image: bruteforce2.jpeg]](http://pentestlab.files.wordpress.com/2012/12/bruteforce2.jpeg)
Remaining Positions
As an attack type we will choose the cluster bomb because this type of attack it can take each word of the username list and it can run it against each word of the password list in order to discover the correct credentials.
Now it is time to set the payloads on the three positions.So we will load our wordlists that contains usernames and passwords in the payload options of Burp and for the 3rd position we will just put as an option $Login$.In the next three images you can see this configuration.
![[Image: bruteforce3.jpeg]](http://pentestlab.files.wordpress.com/2012/12/bruteforce3.jpeg)
Set 1 – Usernames
![[Image: bruteforce4.jpeg]](http://pentestlab.files.wordpress.com/2012/12/bruteforce4.jpeg)
Set 2 – Passwords
![[Image: bruteforce5.jpeg]](http://pentestlab.files.wordpress.com/2012/12/bruteforce5.jpeg)
3 – Login
Everything now is ready and we can start the attack on the Intruder.The Intruder will start sending HTTP requests to the form based on our payloads and it will try all the possible combinations.
![[Image: bruteforce6.jpeg]](http://pentestlab.files.wordpress.com/2012/12/bruteforce6.jpeg)
Cluster Bomb – Intruder
After the inspection of the responses we will notices that Burp has successfully logged in under the credentials smithy/password.
![[Image: bruteforce7.jpeg]](http://pentestlab.files.wordpress.com/2012/12/bruteforce7.jpeg)
Discovery of valid credentials
We can now go back to the application and to try to get access to the admin area with this username and password.
![[Image: bruteforce8.jpeg]](http://pentestlab.files.wordpress.com/2012/12/bruteforce8.jpeg)
Access in the admin area
Conclusion
As we saw in this post Burp is also capable to perform brute force attacks against web applications.Login forms can be found almost in every web application and the intruder tool can help the penetration tester to automate his tests.The discovery of valid administrator credentials can make the difference in black-box penetration tests.
Source: https://pentestlab.wordpress.com/2012/12/21/brute-force-attack-with-burp/
Note, this is not my work.
RE: Brute Force Attack With Burp - Faner - 12-22-2012
Nice tutorial, have been looking for something like this few weeks ago. Thanks for sharing.
P.S. Seems your posts and reputation ratio is 2:1. Pretty impressive.
RE: Brute Force Attack With Burp - FunKx - 12-22-2012
Where can I get this tool? Possibly, for free?
RE: Brute Force Attack With Burp - Faner - 12-22-2012
(12-22-2012, 01:06 PM)FunKx Wrote: Where can I get this tool? Possibly, for free?
It's burp suite. You can download free version from here: http://www.portswigger.net/burp/download.html
RE: Brute Force Attack With Burp - compfixing - 12-23-2012
Thank for sharing, I need it since I wanna be a penetration tester.
RE: Brute Force Attack With Burp - FunKx - 12-23-2012
Well, the free version looks kinda sucky. Thanks anyway.
RE: Brute Force Attack With Burp - followfacebook - 12-23-2012
really a nice tutorial. thanks for sharing this with us.
RE: Brute Force Attack With Burp - freya - 12-23-2012
(12-23-2012, 06:11 PM)followfacebook Wrote: really a nice tutorial. thanks for sharing this with us.
your welcome!
RE: Brute Force Attack With Burp - juggernaughts0 - 08-02-2014
(12-23-2012, 06:51 PM)freya Wrote:(12-23-2012, 06:11 PM)followfacebook Wrote: really a nice tutorial. thanks for sharing this with us.
your welcome!
This is exactly why i joined the forum, most of my questions have been answered... THANK YOU!
