1

I am working on a security assessment for an online application. When testing the pin verification mechanism and possibilities of brute force, I came across a post request that looks like the below

POST /verify HTTP/1.1
Host: 
Origin: 
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Cache-Control: no-cache

pin_1=1&pin_2=2&pin_3=3&pin_4=4

I want to run Burp Intruder to test all values for the 4 different pin digits.

 pin_1=0&pin_2=0&pin_3=0&pin_4=1 0001
 pin_1=0&pin_2=0&pin_3=0&pin_4=2 0002
 pin_1=0&pin_2=0&pin_3=0&pin_4=3 0003
 pin_1=0&pin_2=0&pin_3=0&pin_4=4 0004 etc...

Is there a way to do that with Burp Intruder?

2 Answers 2

2

Yes. Burp can do that. Here is a good overview about the different attack types of Burp Intruder.

What you are looking for is the "Cluster Bomb" Type with each of the four payload set to numbers from 0 to 9.

0
3

Yes. Intruder attack type "Cluster Bomb", set each of the parameters to digits from 0-9 (I'd probably go for Brute Forcer, with max-length 1), hit go.

It'll probably not work in the order you've shown, but it'll cover everything eventually - there are only 10000 possibilities, so the slow bit will be network lag and remote end checks.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .