And as you know, we're going to see the Batsuit intruder, uh, you can see the see the section of
the intruder and what you can do with this intruder is you can brute force these requests so you can
see the target and you can see the positions.
So this is a basic example they are given and the payroll positions you need to define which parts of
the request you need to brute force.
So you can see there is there are some areas between the distorter are so, um, this is this is a door.
So you can see this in this sense, there is a valley with the green like P1 and P2 area.
So these are the positions, values.
And what you can do is you need to set some variables you need to build for supposing I want to for
the key.
I was at the content of the key to this.
Darwell was.
So in that way you can set these values and you can perform the, uh, some of these attacks, sniper
attack, uh, battering ram, pitchfork and crushable.
So the disadvantage exurbia, an intruder, this sniper attack used to enter and attacks.
That means if you're going to need to add the usernames, are the passwords you need to brute force,
are the data you need to, uh, replace in these variables.
So if admin, I want to admin and I can add this risk so I can add the list in this balance.
And this sniper is like is to end.
It will check all the combinations and this battering ram one is two one one one at a time and then
it will not check, one is two.
And so in that these are four periods who, uh, only one parent.
If you have multiple sets of parents, you can use this for rest of them.
OK, well, you see it an example so that you get a clear understanding of my mother's variable.
Two is running, uh, an IP address, one nine two zero one six zero zero one, not one.
So as you can see, where will do and we need to go into this damnable Web application, so how do I
know I got so the password Edwyn username and password is password.
So after you going through some exercises knowing this, you know, we're going to sort of brute force
success in order to set the bar.
And I have already set my proxy to bar and there is a username and password admin and admin for type
enter.
It's just username and password and you can see the discerning the parameters, usernames and passwords
go straight.
So what we're going to do is we need to send it to the Saudis and this means this proxy and go through
the.
And you can see the latest request is this all of this request using this username and password, it
is, uh, in order to take a look at this point, it says, OK, uh, but it is an error.
So what we're going to do is right.
Click on this.
And to control the agency.
Intruder is writing in the orange now on this, too.
So there is a new tab has been opened for about request.
You can see the positions.
So this person has already identified some positions for you.
We need to clear this up to clear all of these various positions.
We can create this one.
And what I want to do is I want to prep for this segment.
So instead of it, I can pretend values and our values or whatever.
And I can't I want to click at and now you can see that when this placeholder has been placed, now
I want to do the same for the parser feel so no, whatever I do in this petrolist, it will be checked
with every each and every combination of this one and the.
So I went to placeholders, so.
Well, what do you want me to try?
One tool for Perutz, one and two.
So first I want to separate.
One is like username, admin, nickel or temp etc. So you if you want to import from the order, you
need to open the whole list and copy all this controversy and push it in here.
Because in the community we cannot import directory at the firewall and you can only add in a portion.
So that's why you need to control and controversy here so that these are for the user names and countries
to decide to look at this one.
And you can see parser.
So I know this, uh, password that is a parser admin password.
Let me.
Oh, yeah, I'm just starting the answer just to make sure that you get the correct answer of the past
six years.
So that's where I'd been brought up to.
I know what you want to do is you need to click on the.
OK, OK.
Now, as you can see, some requests going on.
So as you can see, the parent one and parent has been executed on all the combinations possible.
You can see this one to transfer to another section of the default.
One had been admin.
And as you can see, the second one is admin password, which you got the rent for for it.
But right now, if you click on this remaining one, the actual password is admin and the password.
But for remaining are the request.
It failed, but we got some responsibility.
Take a look at this response.
Is two hundred OK?
And we got the error.
That is login for you so you can see username and password.
So if you think, uh, Rike are these items are failed because they have the same rate.
So this particular page will be given to you whenever the user name or password is incorrect.
Right.
Because electronical and temp and all these are failures.
And I get the same content because the original page is the same.
So if you type anything admin and blah, blah, blah, and you get the same page and the rest of the
page will be the same, it's for to what you can see, there is one response that has gotten different,
because if we login, the details can generate because the routing page and the report are not the same
we can see here.
I used to work under the area, so that is our record.
So it just you can directly get this, uh, Carter user and the password using different click on this
line to sort it in increasing order and click on again to sort it in decreasing what you can see, the
highest bite will be displayed first.
So I hope you understood this one.
Let me try it again and password.
So as you can see, we are going to the possibility that it is different than previous error messages,
that username and password.
So this is how you use the intruder.
You can also do the excusing action in place of these usernames, but we will see them in a very interesting
section.
No need to worry about that.
This is the basic quality of intruder in any request.
If you want to brute force any of this parameter, you can use intruder.
All you need to do is first capture the request and then send it to intruder and then put the positions
as you like and then set the payload and just started.
So I recommend you use a cluster bomb if you are to build our sniper for one.
PELOSO So that's about this video.
I hope you have understood.