-: Welcome back.
And in this video I want to talk about another cool feature
of Burp Suite that could allow us
to perform the brute forcing
of a login page a lot more easier
than we did with Hydro Tool.
So Burp Suite, besides you being able
to inspect all the packets
and intercept the packets and change them,
you can also do some other cool things as well.
And one of those cool things is brute forcing a login page.
Now this is something that we're going to perform
with the community version
and the community version of Burp Suite
has some limitations.
The brute forcing will not go as fast as
if you, for example, had the pro version, but nonetheless
let us see how it would look like.
So let's go and visit the login page of our DVWA.
If I navigate right here and here
we must log in to our DVWA.
The first thing that we want to do is we want to
specify any credentials right here, for example
test and test.
And once we click on login
this request that we just performed
on our DVWA page will be saved inside of our Burp Suite.
So under the targets, we got our target machine right here.
And if I find the packet,
here it is.
Here is the packet that we send.
So we send a post request and we send our username
of test and password of test to the target webpage.
Now what we want to do,
in order to perform the brute forcing attack is
we want to first right click on this packet
which we use to send our username
and password and we want to send it to Intruder.
Click on that and you will see this Intruder bar light up.
You want to navigate to the Intruder.
And here there are some options that we want to set
before being able to brute force a webpage.
So here under the Target tab, there is nothing
that we want to change.
Let us just move on to the Positions tab.
And in the Positions tab you will see this request
that we just sent.
You will see some of the fields that are already selected
and you will see this attack type bar up here.
The first thing that we want to change is we want to
change the attack type from sniper to cluster bomb.
And what this simply means is since we are going to
brute force both username and password,
we want to be able to send both of them at the same time.
And we can do that with the help of cluster bomb.
If you, for example, knew the username and you just
wanted to brute force the password, you could select right
here, sniper, and then you could
just brute force a password.
Right now we're going to go with the cluster bomb
and here we got the five fields selected.
Now we don't need all of them, we only need the username
and password field selected.
So what we can do is we can click on this clear button
it will unselect all of these fields, and then
to select the fields that we want, we can
just double click on the field.
For example, username equals test.
I double click on test, it will select it.
Then I click on add and I do the same for the password.
Select it right here and I click on add.
This will select just username and password.
And once we do that, we can navigate
to the payload step where we are going to see bunch
of other options that we can also set.
So under these payload sets
this will be the payload set for the username.
And if I select this number two
this will be the payload set for the password
because those are the only two fields that we selected.
If I go with the username first,
so I change right here to one,
I will select the payload type to be a simple list
because we are going to brute force
with a list and under the payload options,
I want to load that list.
So I just click on this load button
then I can find usernames.txt, and you can see
by default it'll load all of the usernames from that list.
Now I can delete this empty field.
We don't really need it.
And once I do that,
once I load the username list right here
I can change from one to two
and now I leave it once again on simple list.
And here I want to load the passwords.txt.
So once again, I find the passwords.txt
and it will load all of the passwords from that file.
Once all of that is ready, that would be pretty much it.
We are ready to start our attack.
So if I click right here on start attack
it'll tell me that the community edition
of Burp Suite contains a demo version of Burp Intruder.
So some functionality will be disabled.
We already knew that.
So let's just go and click on, okay,
and this will start our attack.
Down here we can see the progress bar
as to how fast this goes.
And you will notice it goes a little bit slower
than the Hydra Tool, but nonetheless
it is still brute forcing our page.
Let's wait for it to finish.
And it has finished, but it seems
that we didn't get any results right here.
And by the way, inside of the Intruder
how we can search for results is you can see all
of the combinations of usernames and passwords right here.
We can see the status and we can also see the length.
Now the length for the correct username
and password will in 99.9% of cases be different
than the incorrect usernames and passwords.
And in this case it seems
that all of them have the same length.
So for some reason it
didn't manage to find our correct username and password.
Now that would be due to many reasons,
but if I just select one of the combinations
and I go to the response, we get the 302 Found.
If I scroll down inside of the response
it doesn't give us any HTML content.
This usually means that it is performing redirection.
And if I go to our options
inside of our intruder all the way down
under the options we get follow redirections never.
So what I'm going to do is I'm going to check this
on always and I'm going to start the attack once again.
Click on okay,
and now we can see
it has different type of length.
Now all we need to do is wait
for the combination of admin and password
and hopefully this time we are going to get different length
of the response
for the correct username and correct password.
So let's wait for this to finish.
Okay, so it has finished.
And let's scroll all the way down.
We can see every response has the length of 1638.
And if I scroll down here
we can see that the combinations of admin and password
both capital and lower case, have different length.
This is a pretty good indication
that these are the correct usernames and correct passwords.
We can also see that it did indeed perform the redirection,
as we can see multiple requests
and multiple replies right here.
So that will be about it.
This is a simple way that you can perform brute forcing
with the help of Burp Suite.
Now, I'll still prefer the Hydro Tool due
to it being a little bit faster than the Burp Suite Intruder
but this one however, is easier to perform since for
Hydra you need to perform different type
of syntax and sometimes it might not work.
While this is just setting some of the options
selecting the fields, and running the brute force attack.
Now that we finish this
in the next section
we are ready to start our coding projects
regarding the web application penetration testing.
See you there.