Intruding with Intruder
Burp Intruder allows a tester to brute-force or fuzz specific portions of an HTTP message, using customized payloads.
To properly set up customized attacks in Intruder, a tester will need to use the settings available in the four subtabs of Intruder:
Figure 2.17 – Intruder and subtabs available
Getting ready
A tester may wish to fuzz or brute-force parameter values within a message. Burp Intruder eases this process by providing various intruder attack styles, payloads, and options.
How to do it...
- Browse to the login screen of Mutillidae and attempt to log in to the application. For example, type a username of
adminand an invalid password ofadminpass. - Find the login attempt in the Proxy | HTTP history tab. Your request number (that is, the # sign on the left-hand side) will be different from the one shown next. Select the message that captured your attempt to log in.
- As the login attempt message...
