Burpsuite tutorials and tips for HTTP brute brute force hack

Regular payload test for USERNAME/PASSWPRD, I think we should have no problem, but for authorization:basic dxnlcm5hbwu6cgfzc3dvcmq= such a problem, a lot of friends puzzled.

Before, I remember I introduced Burpsuite's Intruder function (Burpsuite tutorials and techniques of SQL injection), presumably a lot of people have no impression, here, with the HTTP brute to revisit the intruder function.

Follow the examples below (for illustrative purposes only, whichever is your goal)

auth=dxnlcjpwyxnzd29yza==, which is our key position.

So how do you do it? The approximate operation process is as follows:

1. Decrypt the base64 string 2.  Generate Test Payload3.  testing with the payload        

1. Base64 String for decryption verification

The decrypted string is:

Auth=user:password   

The problem is, for User:password this form of string, how do we set payload?

It must have been a lot of people here. To solve this problem, let's look at the second part.

2. Generating payload for testing

For this format, it is not possible to use Burpsuite to complete the test successfully, that will need to enrich the corresponding payload.

My approach is to use Burpsuite to generate the payload text I want.

Auth=§user§§:§§password§    

Set 3 payloads,

1------§user§2------§:§3------§password§  

Then build payloads according to the intruder battering ram/pitchfork/cluster bomb (generated according to your own requirements)

Here I choose to take cluster bomb as an example, use intruder to generate the payloads you need, and then save it to a text file.

There's a detail when you save it. Delimiter Select customer

3. Test with payload

When testing, we choose Sniper, we only need a payload variable

If there are deficiencies, please correct me.

Burpsuite tutorials and tips for HTTP brute brute force hack