I am working on a security assessment for an online application. When testing the pin verification mechanism and possibilities of brute force, I came across a post request that looks like the below

POST /verify HTTP/1.1
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Cache-Control: no-cache


I want to run Burp Intruder to test all values for the 4 different pin digits.

 pin_1=0&pin_2=0&pin_3=0&pin_4=1 0001
 pin_1=0&pin_2=0&pin_3=0&pin_4=2 0002
 pin_1=0&pin_2=0&pin_3=0&pin_4=3 0003
 pin_1=0&pin_2=0&pin_3=0&pin_4=4 0004 etc...

Is there a way to do that with Burp Intruder?

2 Answers 2


Yes. Burp can do that. Here is a good overview about the different attack types of Burp Intruder.

What you are looking for is the "Cluster Bomb" Type with each of the four payload set to numbers from 0 to 9.


Yes. Intruder attack type "Cluster Bomb", set each of the parameters to digits from 0-9 (I'd probably go for Brute Forcer, with max-length 1), hit go.

It'll probably not work in the order you've shown, but it'll cover everything eventually - there are only 10000 possibilities, so the slow bit will be network lag and remote end checks.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .