Welcome back.
And in this video, I want to talk about another cool feature of Burset that could allow us to perform
the brute force Singapore login page a lot more easier than we did with Hydra.
So, Broussard, besides you being able to inspect all the packets and intercept the packets and change
them, you can also do some other cool things as well.
And one of those cool things is brute forcing a login page.
Now, this is something that we are going to perform with the community version and the community version
of Burset has some limitations.
The brute force will not go as fast as if you, for example, had the provision, but nonetheless,
let us see how it would look like.
So let's go and visit the login page of our TV W8.
If I navigate right here and here, we must log in to our TBWA.
The first thing that we want to do is we want to specify any credentials right here, for example,
test and test.
And once we click on login, this request that we just performed on our TBWA Page will be saved inside
of our troops.
So under the targets, we got our target machine right here.
And if I find the packet, here it is.
Here is the packet that we sent.
So we sent the post request and we sent our username of test and password of test to the target web
page.
Now, what we want to do in order to perform the brute forcing attack is we want to first right.
Click on this packet, which we use to send our username and password, and we want to send it to intruder.
Click on that and you will see this intruder bar light up, you want to navigate to the intruder and
here there are some options that we want to set before being able to brute force a Web page.
So here under the target tab, there is nothing that we want to change.
Let's just move on to the positions that and in the positions step, you will see this request that
we just sent.
You will see some of the fields that are already selected and you will see this attack type bar up here.
The first thing that we want to change is we want to change the attack type from sniper to cluster bump.
And what it simply means is, since we are going to brute force both username and password, we want
to be able to send both of them at the same time.
And we can do that with the help of cluster bump.
If you, for example, knew the username and you just wanted to brute force the password, you could
select right here, sniper, and then you could just brute force a password.
Right now, we are going to go with the cluster bomb and here we got the five fields selected.
Now, we don't need all of them.
We only need the username and password fields selected.
So what we can do is we can click on this clear button, it will and select all of these fields and
then to select the fields that we want, we can just double click on the field.
For example, username equals test, I double click on test.
It will select it.
Then I click on ADD and I do the same for the password selected right here and I click on ADD.
This will select just username and password and once we do that, we can navigate to the payload step
where we are going to see a bunch of other options that we can also set.
So under this payload sets, this will be the payload set for the user name.
And if I select this number two, this will be the payload set for the password because those are the
only two fields that we selected.
If I go with the user name first, so I change right here to one, I will select the payload type to
be a simple list because we are going to brute force with a list and under the payload options.
I want to load that list.
So I just click on this load button.
Then I can find usernames that the 60 and you can see by default it followed all of the user names from
that list.
Now I can delete this empty field.
We don't really need it.
And once I do that, once I load the user names list right here, I can change from one to two.
And now I leave it once again on simple list.
And here I want to load the passwords.
So once again I find the password suffix and it followed all of the passwords from that file.
Once all of that is ready, that would be pretty much it.
We are ready to start our attack.
So if I click right here on Start Attack, it will tell me that the community edition of BURPS, it
contains a demo version of Berp Intruder.
So some functionality will be disabled.
We already knew that.
So let's just go and click on, OK?
And this will start our attack.
Down here, we can see the progress part as to how fast this goes, and you will notice it goes a little
bit slower than the hydro tool, but nonetheless, it is still brute forcing our page.
Let's wait for it to finish.
And it has finished, but it seems that we didn't get any results right here.
And by the way, inside of the intruder, how we can search for results is you can see all of the combinations
of usernames and passwords right here.
We can see the status and we can also see the length, not the length 40.
Correct username and password will in ninety nine point nine percent of cases, be different than the
incorrect usernames and passwords.
And in this case, it seems that all of them have the same length.
So for some reason, it didn't manage to find our correct username and password.
Now, that could be due to many reasons, but if I just select one of the combinations and I go to the
response, we get the three or two found.
If I scroll down inside the response, it doesn't give us any HTML content.
This usually means that it is performing redirection.
And if I go to our options inside of our intruder all the way down under the options we get follow redirections.
Never.
So what I'm going to do is I'm going to check this on always and I'm going to start the attack once
again.
Click on OK.
And now we can see it has a different type of length.
Now all we need to do is wait for the combination of admin and password and hopefully this time we're
going to get different length of the response for the correct username and password.
So let's wait for this to finish.
OK, so it gets finished and let's scroll all the way down, we can see every response has the length
of one six, three eight.
And if I scroll down here, we can see that the combinations of admin and password, both capital and
lowercase, have different length.
This is a pretty good indication that these are the correct usernames and passwords.
We can also see that it did indeed perform the redirection as we can see multiple requests and multiple
replies right here.
So that would be about it.
This is a simple way that you can perform brute forcing with the help of it.
Now, I'll still prefer Dehydrator due to it being a little bit faster than the Burset intruder.
But this one, however, is easier to perform since for you need to perform different type of syntax
and sometimes it might not work while this is just setting some of the options, selecting the fields
and running the brute force attack.
Now that they finish this in the next election, we are ready to start our coding projects regarding
the Web application penetration testing Suder.