Intruder is a great tool which allows us to perform different types of attacks that can be used to find all kinds of vulnerabilities. Some of the most common attacks that can be performed with Intruder are as follows:
- Bruteforce
- Fuzzing
- Enumeration
- Application layer DoS
We start off picking up a request from our captured requests:
- Right-click on the request and select
Send to Intruder:
- Switch to the
Intrudertab. We need to specify a payload position, and we can do that by selecting the place we want or selecting the payload and clicking on theAdd §button:
- In our case, since we are performing a login brute force, we will use the attack type
Pitchfork:
- Next, we switch to the
Payloadstab. This is where we will enter our payloads:
- We choose set
1, and as we are bruteforcing, we can choose a simple list as thePayload type. - In the
Payloadoptions, we specify the list of words we want the app to be tested against. We can either enter them manually, or we can choose a pre...