0

In BurpSuite, you can brute force a password of any length and any character set (in my case, alphanumeric passwords between 1 to 7 characters long). How does one do it in OWASP ZAP, without actually generating a password list containing alphanumeric passwords between 1 to 7 characters long?

enter image description here

Improve this question

1 Answer 1

Reset to default
1

Option 1

With ZAP you could do this using a Regex (*Experimental*) payload, such as [a-z0-9]{7}.

Ex (passwords/strings length 7): enter image description here enter image description here

You'd probably have to create multiple fuzzers to handle the length variation, although doing passwords <6 char is probably pointless. If you're target accepts passwords that are super short they have other issues.

Option 2

You could create a script payloadgenerator, based on something like: https://github.com/noamsauerutley/string-permutations

Math

Keep in mind this works out to (36^7) == 78,364,164,096 possible passwords. If you had 20 threads going once per second, that's 3,918,208,205 seconds or like ~124 years.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .