Brute Force Login Using Burp Suite Intruder

Brute Force Login Using Burp Suite Intruder

tools: burp suite & iceweasel
web app: mutillidae 

Here I use burp suite intruder to brute force the login of the admin user (remember we enumerated this in an earlier video)

here is the full video of how to brute force a login using burp suite

In short

• ensure proxy is working 
• capture a known bad request 
• right click  on request and sent to burp intruder
• set payload position
• load payloads
• attack

Its worth noting the following findings; in short; (in mutillidae)

• where there is a response code of 302 a successful password has been found 
• the length differs when compared to non successful logins, for example in the video 

successful logins have a length of 48763 (in mutillidae via burp suite)
unsuccessful logins have a length of 48669 (in mutillidae via burp suite)