[D@rk TruTH]

• Hy sinister.ly members I am sharing one other tutorial video.
  
• This video is about "Brute Forcing Login Page using Burp Suite"
  
• please leave queries in this thread...
  
• like my video if you like it...
  

Keep this thread alive

[pvnk]

Mr. Joshi, you weren't joshing about in this video.

[D@rk TruTH]

Mr. Joshi, you weren't joshing about in this video.

Lol

[mothered]

Provided there's no account lockout policy In place, whereby after x-amount of Invalid login attempts the account Is locked for a certain duration, and there Isn't a password complexity requirement Implemented (hence easy to guess/brutforce algorithms) this'll work well.

Appreciate the contribution, thanks.

[D@rk TruTH]

Provided there's no account lockout policy In place, whereby after x-amount of Invalid login attempts the account Is locked for a certain duration, and there Isn't a password complexity requirement Implemented (hence easy to guess/brutforce algorithms) this'll work well.

Appreciate the contribution, thanks.

that is true....modern web apps have counter measures installed for stopping brute forcing....

[mothered]

that is true....modern web apps have counter measures installed for stopping brute forcing....

That said, there's so many that don't and that's where this comes to good use.

I've been assessing, Identifying vulnerabilities, and exploiting them via various attack vectors for a long time and the Insecurity of websites Is nothing short of appalling. I can confidently say that your methodology here will work more so than not.

[dangermouse]

that is true....modern web apps have counter measures installed for stopping brute forcing....

That said, there's so many that don't and that's where this comes to good use.

I've been assessing, Identifying vulnerabilities, and exploiting them via various attack vectors for a long time and the Insecurity of websites Is nothing short of appalling. I can confidently say that your methodology here will work more so than not.

How are you identifying which websites have account lockouts? Just manually trying the website?

[Bish0pQ]

that is true....modern web apps have counter measures installed for stopping brute forcing....

That said, there's so many that don't and that's where this comes to good use.

I've been assessing, Identifying vulnerabilities, and exploiting them via various attack vectors for a long time and the Insecurity of websites Is nothing short of appalling. I can confidently say that your methodology here will work more so than not.

How are you identifying which websites have account lockouts? Just manually trying the website?

Or you script a tool for it.

[mothered]

How are you identifying which websites have account lockouts? Just manually trying the website?

When I assess websites, I do It on a case-by-case basis via user Intervention, so yes It Is performed manually.

Sometimes the webserver returns a message that there's x-amount of attempts remaining, whilst other times It'll lockout for a certain duration there and then.

[Bish0pQ]

Do you have to manually check every response for the "index.php"? I mean, its not a problem when you run a wordlist of about a 100, but if you want to unleash 20 k passwords on the target, do you have to go through all 20k of those responses?