Brute Force

Objective

Your goal is to get the administrator’s password by brute forcing. Bonus points for getting the other four user passwords!

Security Level: Low

The application provides us with two input fields in order to enter the username and the password.

Let's enter admin as both.

Let's intercept the request in Burpsuite.

We can now forward this request to the Intruder to automate the attack.

After adding a field to the password, we can move on to setting up the substitution payload.

For the payload type we want a simple list, more specifically the darkweb2017-top100.txt passwords lists from the seclists collection.

Before we start the attack there is something important that we have to do. In the Options tab, we can set the string to grep for.

We can set it to the following:

Username and/or password incorrect.

Let's start the attack.

We can immediately see that the response for password did not include the string.

Let's take a closer look at the response.

We can see that it greets us with a welcome message. This means that the password is password.