Document 13

Here's a condensed version of the steps for the Burp Intruder username and password
enumeration attack:
Step 1: Username Generation using Burp Intruder
1. Use Burp's HTTP history to find a failure message for a username-based

authentication mechanism.
2. Highlight the username in the request, right-click, and Send to Intruder.
3. In Intruder > Positions, confirm that Burp has added the username as a payload.
4. Set Sniper as the attack type.
5. In the Payloads tab, select Username generator from the dropdown.
6. Enter your input (e.g., Carlos Montoya) and add potential usernames.
7. Set the number of usernames in Maximum payloads per item.
8. Click Start attack to test usernames and analyze results for unique error
responses.
Step 2: Username Enumeration via Different Response
9. Submit invalid credentials on the login page with Burp running.

10. Locate the POST /login request in Proxy > HTTP history.
11. Highlight the username in the request and Send to Intruder.
12. In Positions, ensure the username is set as the payload, and leave the password
static.
13. Use the Simple list payload type and paste candidate usernames.
14. Click Start attack and analyze the Length column for responses showing different
error messages like Incorrect password (indicating a valid username).
15. Replace the username with the identified one, and set the password as the payload
position.
16. Add candidate passwords in the Payloads tab and start the attack again.
17. Examine the Status column to find the correct password (look for a 302 status
code).
18. Log in with the identified username and password.
These steps will help you perform username and password enumeration attacks using
Burp Intruder effectively.
4o
You said:
ok... how to perform this process in dvwa
ChatGPT said:
ChatGPT
To perform a username and password enumeration attack in DVWA (Damn Vulnerable

Web Application) using Burp Suite, follow these step-by-step instructions:
Prerequisites:
19. DVWA Setup: Ensure DVWA is installed and running on your local server.
20. Burp Suite Setup: Make sure Burp Suite is installed and your browser is configured
to use Burp as a proxy.
21. DVWA Security Level: Set the DVWA security level to low to allow easier
exploitation.
Step-by-Step Process in DVWA
Step 1: Capture the Login Request
22. Open DVWA in your browser.

23. Go to the login page.
24. Enter an invalid username and password (e.g., admin123 / password123) and
click Login.
25. In Burp Suite, go to Proxy > HTTP history and find the POST /login.php request.
26. Right-click on the request and select Send to Intruder.
Step 2: Set Up the Intruder Attack
27. In Burp, go to Intruder > Positions.

28. You will see the username and password parameters in the request. By default,
Burp will highlight them with § symbols. If not, manually highlight the username
parameter.
29. Clear the payload positions by clicking Clear and then manually highlight only the
username field to set it as the payload position (leave the password static for now).
30. Select Sniper as the attack type.
Step 3: Add Payloads (Username List)
31. Go to the Payloads tab.

32. In the Payload Type dropdown, select Simple list.
33. Enter a list of candidate usernames (e.g., admin, user, test, guest), or you
can use a more extensive username list.
34. Click Start attack to begin the enumeration.
Step 4: Analyze the Results
35. When the attack is finished, go to the Results tab.

36. Sort the results by the Length column. The correct username will likely have a
response of a different length compared to incorrect usernames.
37. If you see a message like Incorrect password instead of Invalid username, you've
identified a valid username.
Step 5: Password Enumeration
38. Go back to the Positions tab in Intruder.

39. Clear the current position and set the password field as the new payload position.
40. In the Payloads tab, clear the username list and enter a list of candidate
passwords.
41. Click Start attack.
42. Once the attack is completed, check the Status column for a different status code,
such as 302 (indicating a successful login).
43. The payload associated with this response will be the correct password.
Step 6: Log in
44. Using the identified username and password, log in to DVWA to confirm successful
access.
Summary:
• Username enumeration is done by identifying usernames that generate a different

response (e.g., Incorrect password).
• Password enumeration involves testing various passwords for the identified
username and checking for a status change, like a 302 Found response.
This method is effective for exploiting weak login mechanisms in DVWA using Burp Suite.

Document 13

Uploaded by

Copyright:

Available Formats

Document 13

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Document 13

Uploaded by

Copyright:

Available Formats

Here's a condensed version of the steps for the Burp Intruder username and password

Step 1: Username Generation using Burp Intruder

1. Use Burp's HTTP history to find a failure message for a username-based

Step 2: Username Enumeration via Different Response

9. Submit invalid credentials on the login page with Burp running.

ok... how to perform this process in dvwa

To perform a username and password enumeration attack in DVWA (Damn Vulnerable

Step-by-Step Process in DVWA

Step 1: Capture the Login Request

22. Open DVWA in your browser.

Step 2: Set Up the Intruder Attack

27. In Burp, go to Intruder > Positions.

31. Go to the Payloads tab.

Step 4: Analyze the Results

35. When the attack is finished, go to the Results tab.

Step 5: Password Enumeration

38. Go back to the Positions tab in Intruder.

• Username enumeration is done by identifying usernames that generate a different

You might also like