All right.
Let us take a look at another option that perhaps it gives us, which is intruder.
Now, you can consider intruder as something made for brute force attacks.
The definition behind it is that it allows us to change anything in the request and forward it, but
it also allows us to change certain parts of the requests by reading stuff from our list.
Now, it might sound confusing, but let me show you what I mean, make sure that intercept is turned
off.
Make sure that you have the virtual machine started and let's visit our TV, a login page.
It will lead us to this page and we should be able to find it under the target tab and right here.
So here it is.
As we can see, this is the gate request that searched for a log in DOT BHP, which is the exact link
right here.
Now, we can send this request straight from here to the intruder by clicking on it and clicking send
to intruder.
And as usual, you will see this intruder tab light up, it will become orange.
Go to it.
And this is pretty much all we get.
Now, it might seem nothing at the beginning, but we do have four different tabs for this request.
So once we switch the deposition step here, we can see our request.
Now, you will see some of the things here already light up.
And these are the things that we do want to change because they might be important for us, which in
this case is correct, since these are cookie values and in some attacks, we might want to change the
cookie value.
But let's go with a different HTP request.
Let's go with the next request where we try to log in.
So let's go test and test, which is incorrect login.
We will get the login filled error and now let's try to find that request right here.
It will be a post request.
You can already filter it out since all of these other requests are get request and here is the only
post request.
And down here, we can see that it does contain our username and password.
So we can either go here on actions and send it to intruder or we can just.
Right.
Click here and send it to intruder.
And once we visit the intruder, we will have another tab opened up.
And if we go to the positions, here is our HTP login request.
Now, you will see that these options as well are now printed in green because as I mentioned, it recognizes
them as something that could be important for us.
Now, what I usually like to do is I like to clear out all of these other options and this will remove
any green print that perhaps it gives by default.
Now we have something called paillard positions, and as you can see, there is this attack type option
that we can choose from.
If we click on this arrow, we will get four different attack types.
Now, to read more about these attack types, what I advise you to do is click on this question mark
and this question mark will open up a page that gives you all the detailed information about these attack
types, as well as what you can do with the intruder.
If we scroll all the way down, it also gives you the explanation for ad clear and out button, which
are the buttons right here on the right side.
And under the attack type, we can read about each and every attack type that we want.
For example, the sniper attack type uses only a single set of payloads.
It targets each payload position in turn and places each payload into that position in turn.
Now, in other words, this simply means that with sniper attack type, we can only select one word
right here that we want to change.
For example, let's say that we want to brute force this account, but we do know username and we don't
know password.
We would select the password field and we would use the sniper attack in order to brute force the password
field.
You have some other options that you can use battering ram this year as a single set of payloads.
Now you can read about all of these if you like.
For example, a cluster bump is an option that you would use if you want to brute force both username
and password since as it says right here, this uses multiple payload sets, which means you can select,
for example, password and username.
And then you can brute force both of them at the same time.
Now let me show you what I mean.
For example, let's say that we do know the username, which is Admon, but we don't know the password
and we just set it to test.
What we would want to do in order to get into this account is we would want to select this test and
click on that and you will see that it will become green.
Once we do that.
We told the purpose that we're going to try to brute force this word right here.
Then we can go to payloads and under the payloads in this window right here.
We want to load our list now.
You can either add the list by clicking on this load button and then navigating through your file system
and trying to find that the next list that you want to use or you can add some random words right here.
For example, test one, two, three, test one, two, three, four.
One, two, three, four, five.
Let's see route.
And let's also add the correct password just so we can show that it does work.
And let's go password and password.
One, two, three.
Now, let's say that this is our list that we want to use.
Once we select it right here, we can click on this start attack.
It will give us this error, which we want to click on, OK?
And it will start our attack.
And what intruder will do is it will send an HTP request with changed password and it will change password
with these items that we specified in our list.
It will go for each password and it will perform the request and we can see that we got status three
or two, which, if you remember it does redirect us after we send this request.
But what you can do is you can, for example, select the correct password.
Now, in this case, we do know what incorrect and what the correct password is.
So we can just select the incorrect one and we can.
Right.
Click on it and click on request in browser, or we can also choose show response in browser.
If we click on that, it will give us a link that we want to copy.
We can copy that link.
Go right here and paste it.
We get the Loganville printed a couple of times and we do get wrecked login right here.
Now, this is a bug because we only requested one password, but it does give us that one of these eight
passwords for our list did work and we did manage to log in since we already know which one it is.
Let's go to the.
This option, select the correct password, which is admin and show response in browser, copy the link.
We can close this for now and we can go to that link.
And here it is, once we selected, the request for the password was Admon, now it logs are sent because
that was the correct password.
How awesome is that?
So we performed a small brute force attack right here.
Now, this is not that practical and we're going to talk about that more once we get to the brute forcing
part of the course for now on, we just took a look at a very simple brute force attack.
Now we're going to take a look at how we can deal with the problem once it redirects, because we don't
really want to go and visit every single request for every single password just to see whether we manage
to log in or not.
We want another way that we can check out which password is correct much faster, right?
Well, we will talk about that in the first part of the course for now.
We checked out the option called intruder, and there are many other options that perhaps it allows
us to use.
However, we're going to check most of them out throughout the course.
We just covered the basics of it right now so we can get familiar with it.
And if there is something that you didn't quite get or didn't quite understand, don't worry.
We will practice it a lot throughout the course for now.
And it's just important that you do know how to navigate through it.
You do know what the target is.
You do know what the proxy tab is.
You do know how to intercept certain requests and how to remove the intercept.
All of that is important.
However, more advanced stuff we are going to cover throughout the course.
Now we are fully ready.
And in the next lecture, we're going to start off with our first vulnerability, which will be HTML
injection see there.