[SOLVED] BurpSuite CE

dr-ing · 04-16-2020, 06:27 AM

Hello,

This is the first time I've used the BurpSuite Intruder and I wanted to do a very simple brute force attack on a local DVWA instance. So I set up the proxy, received the GET request and sent it to the Intruder, where I processed the positions, which looked like this:

Code:

GET /dvwa/vulnerabilities/brute/?username=§aaa§&password=§bbb§&Login=Login HTTP/1.1
Host: 192.168.56.101
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:75.0) Gecko/20100101 Firefox/75.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://192.168.56.101/dvwa/vulnerabilities/brute/?username=aa&password=bb&Login=Login
Cookie: security=low; PHPSESSID=73bkkfotgpfijhnr30e7j12285; acopendivids=swingset,jotto,phpbb2,redmine; acgroupswithpersist=nada
Upgrade-Insecure-Requests: 1

If I now want to edit the 2 positions in the Payload - Tab, I can only select the username - position but not the password one:

Click image for larger version

Name: Screenshot from 2020-04-16 12-46-03.png
Views: 161
Size: 98.1 KB
ID: 33001

I have tested 4 different Burp versions (
- Arch Linux 5.6.4: v2020_2_1 and 2_1_04
- Kali Linux 2020.1: v2.1.07
- Windows 10 17763: v2020_2_1
always in the Community edition).

I haven't (yet) set up/changed anything in the software, I just started it (Temporary Project -> Use Burp defaults).

Does anyone here know the error and a possible fix?

sevendogsbsd · 04-16-2020, 07:02 AM

I use Burp Pro at work daily and have never encountered this issue. Perhaps CE has a limitation? I have access to a CE instance as well so will test this for you and report back.

sevendogsbsd · 04-16-2020, 03:10 PM

I see now - you have to add some usernames to the list (hand enter only), then you can choose "Payload set 2" and enter possible passwords to use. Make sure you are using "cluster bomb" as your attack type.

I did this on the CE edition on my kali box. Hope that helps.

dr-ing · 04-17-2020, 02:22 AM

Quote:

Originally Posted by sevendogsbsd

I see now - you have to add some usernames to the list (hand enter only), then you can choose "Payload set 2" and enter possible passwords to use. Make sure you are using "cluster bomb" as your attack type.

I did this on the CE edition on my kali box. Hope that helps.

Cluster bomb has "fixed" it, thank you very much. I missed on the help video that he changed the attack type.

sevendogsbsd · 04-17-2020, 07:29 AM

Glad you got it working. FYI: we also use OWASP ZAP at work as a proxy and it is very powerful, but...the UI is radically different than Burp and not very easy to figure out. Once you do though, it is entirely free as it's open source.

dr-ing · 04-18-2020, 09:43 AM

Thanks for the info! Yes, I've been using ZAP a little longer than Burp but mainly for automatic scans in combination with Jenkins. With Burp I wanted/would like to test more by myself.