Hack the website password with Burpsuite

• Burpsuite Professional Edition

• A website

Method/Step

2. 1

   Switch to the option option on the Proxy tab, set the proxy address and port: 127.0.0.1:8080.

4. 2

   Start the agent you just set up

6. 3

   Open Internet Properties, select: Connections->lan Settings->proxy Server. Enter 127.0.0.1 and 8080 respectively.

8. 4

   Find a destination URL for

10. 5

    Click "Login" when a pop-up window appears, in order to find a real login URL, we click "Free Registration".

12. 6

    Click "Login" next to enter an account, enter the password "123456". (Do not click the login button first)

14. 7

    Select the "Intercept" option under the Proxy tab, click on the "Intercept is off" button and the button will change to "Intercept is on"

16. 8

    Open the previous landing page and click on the "Login" button.

18. 9

    At this point we will see the packets just intercepted under the burpsuite. You can see the username and keywords we just entered.

20. 10

    Right-click within the text area and select Send to Intrder

22. 11

    Switch to the Intruder tab, select "Target", set the host address and port number, the port number by default is 80, if the website is using the HTTPS protocol, tick "use HTTPS" to switch to 443 port (SSL)

24. 12

    To switch to the positions option, click the "Clear $" button on the right to clear all default parameters.

26. 13

    The mouse selects the text behind username (the user name we entered) and clicks the "Add $" button.

28. 14

    To switch to the "payloads" option, select the "Payload type" to use, here we select "Simple List".

30. Select a password in the "Add from List" below, where we select "8 Letter Words".

32. Switch to the Options tab, set the number of threads and other parameters, as shown in.

34. Click "Intruder" on the menu bar and select "Start attack"

36. When we scan to the same time, we sort by length size. This is where we will see several different packets, many of which are the same, and there are a few packets that are quite basic enough to be correct.

38. Select one of the smaller packets, click "Response" below, and you will see a prompt "username or password is wrong"

40. Similarly, we then select a larger packet, which is, we will see below without prompting "username or password error",

42. When I reopen the login page, I find I can't get in.

44. The initial guess is that the IP is blocked by the site, so we have to change an IP login to try. I use the mobile phone to open the Hotspot link computer, then go to open the Web page is displayed.

46. Enter the username that we just got (take merchant for example) and password 123456. Then click Sign In.

48. Successful Login

Hack the website password with Burpsuite