Burp Suite Detailed Tutorial-intruder module details 3

Burp Suite uses the third chapter of the detailed tutorial serial. 0x02 intruder-built-in payload test using tips built-in payload test options such as:

Today's tips are used by numbers, for everyone: numbers numbers can be used to traverse document IDs, session tokens, and so on. Numbers can be decimal or hexadecimal, integer or fractional, sequentially, incrementally, or completely random.

Today we will look at his magical application in the injection. Hey.
In the article "MYSQL Manual injection Advanced Techniques-limit" We use limit to get the information we need. Everyone should feel that this is a very tedious process. Let's use burp today to customize automated attacks to simplify this tedious process.

First we load the configured statements into intruder for information spying and testing, as shown in:

Then select the parameter values to be tested for the payload, and our idea is to change the value of the limit sliding scale to get the database name. So we take the first parameter of limit as the location of the payload test. Such as:

Then select Numbers in the Payload tab. Such as: Very clear settings, ranging from 1 to 7, with a value of 1 each, incremented sequentially. And then
We start attack test such as: to here everyone will understand the numbers of the powerful bar. Is it very convenient to le? Hey. In fact, more convenient still behind le. O (∩_∩) o haha ~ so each to see the data is not feeling very uncomfortable? Can the burp extract the data we need? Hey. Well, that's the highlight of the day. 0x02 intruder-Page Data extraction first we want to determine where to get the data, where it starts, such as: then we determine where to get the end of the data. such as: the location of the end is very important, otherwise the extracted data is not pure.
We come to the Options tab below the Grep–extract settings to get the page data specific configuration such as: Then we start attack See effect O (∩_∩) o ha! 0X03 Summary is not very convenient? We must not be evil to drag the library Oh, I heard that the burp of the effect of the library is very powerful. Here I only do technical discussion, do not do illegal things. Welcome to discuss with me burp other advanced techniques, my e-mail: [email protected]. Recently, Burp also integrated Sqlmap's

Burp Suite Detailed Tutorial-intruder module details 3