1

I am working on a security assessment for an online application. When testing the pin verification mechanism and possibilities of brute force, I came across a post request that looks like the below

POST /verify HTTP/1.1
Host: 
Origin: 
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Cache-Control: no-cache

pin_1=1&pin_2=2&pin_3=3&pin_4=4

I want to run Burp Intruder to test all values for the 4 different pin digits.

 pin_1=0&pin_2=0&pin_3=0&pin_4=1 0001
 pin_1=0&pin_2=0&pin_3=0&pin_4=2 0002
 pin_1=0&pin_2=0&pin_3=0&pin_4=3 0003
 pin_1=0&pin_2=0&pin_3=0&pin_4=4 0004 etc...

Is there a way to do that with Burp Intruder?

2

Yes. Burp can do that. Here is a good overview about the different attack types of Burp Intruder.

What you are looking for is the "Cluster Bomb" Type with each of the four payload set to numbers from 0 to 9.

2

Yes. Intruder attack type "Cluster Bomb", set each of the parameters to digits from 0-9 (I'd probably go for Brute Forcer, with max-length 1), hit go.

It'll probably not work in the order you've shown, but it'll cover everything eventually - there are only 10000 possibilities, so the slow bit will be network lag and remote end checks.

  • Thank you amigo, that worked :D – The Bee Apr 4 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.