A website I'm looking at for my colleagues has a parameter which is number|number
Where the likely values will be 1-99|1-999 (e.g. 14|234)
How do I configure burp to try all possible values? (Would this be the intruder tool?)
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
You can set up that payload set within the Burp Intruders options.
Just set the payload position in the "Positions" tab in Intruder, and then set the payload type to "Numbers" with your required setup.
For the described scenario with two independent sets for the two positions you should use the "Cluster Bomb" attack type. Then you define two payload sets (one from 1 to 99, the other one from 1 to 999) as described above.
That will iterate through all combinations for payload set 1 while keeping the first element of the second payload set:
Then the intruder will choose the next item from payload set 2 and iterate through all of set 1 again until every combination was tested.
Edit: Forgot to said that you should also check the "Attack type" in the "Positions" tab to fit it to the request you want to perform. Read about the attack types here: http://portswigger.net/burp/help/intruder_positions.html#attacktype (The attack type is just how Burp is going to handle the payloads in the requests).
This code will generate those numbers for you. I'm hoping this will help. Thank you.
for (( i = 1; i <= 100; i++ ))
for (( j = 1 ; j <= 1000; j++ )) do echo -n $i\ $j & echo done
This snippet will echo those numbers, just run in Cygwin or your Unix shell. Chmod to 755