This is far more efficient than an exhaustive brute-force attack, but relies on the user's password being present in your list, which may not always be the case.

One approach for brute-forcing passwords is to use a list of potential passwords, usually collated from previous data breaches. For the examples below, you can assume that the username wiener is valid.įor details on how to brute-force both the username and password in a single attack, see Brute-forcing a login with Burp Suite. For example, you can potentially enumerate a list of usernames using Burp. Identify one or more valid usernames for the target website. For some ideas on how to do this, see the Authentication topic on the Web Security Academy. To run these attacks on real websites, you usually need to also bypass defenses such as rate limiting. The examples below are simplified to demonstrate how to use the relevant features of Burp Suite.

Managing application logins using the configuration library.

Spoofing your IP address using Burp Proxy match and replace.

Testing for reflected XSS using Burp Repeater.Viewing requests sent by Burp extensions using Logger.Resending individual requests with Burp Repeater.Augmenting manual testing using Burp Scanner.Intercepting HTTP requests and responses.Viewing requests sent by Burp extensions.

Testing for SQL injection vulnerabilities.

Testing for parameter-based access control.

Identifying which parts of a token impact the response.

Search Professional and Community Edition

Burp suite pro latest version