so now that we know how to guess the password. One character at a time
in this lecture,
I'm going to show you how to use the cluster bomb option of the intruder
to manipulate two values at the same time.
With this option we can configure the intruder to go through all of the alphabet
to guess the first character of the password and then
automatically increase the number in here to guess the 2nd,
3rd, 4th, 5th and so on.
As a result will be able to just start the intruder have a cup of coffee
and it will recover the long 20 character password for us in one go.
I said recover and not guess because even though we are
guessing the characters we are covering all of the possibilities,
therefore we are guaranteed to recover the password by the end of the attack.
So we're gonna go back to our position and see the way
we use this character in here where we have the A.
To tell the burp intruder to replace this A
with all of the possible alpha numeric characters.
We could also do it in here because we're gonna be going up in this
So we can basically say one to start with one and then
tell burp to go 1234567 all the way up to 20.
So this time we will be changing two variables will be
changing the character that we are selecting from the password.
We're going to be changing the value that we are comparing this character too.
So we're gonna go back to burp and we're
just gonna put that in here and as mentioned earlier
this will be changing the first payload or the first
election will increase the value in here to 20.
And the second selection will increase the or will change the alphabet in here.
And because we have two values that we're changing through this attack is
going to have to change the attack type from sniper to cluster bump
and we're going to go to the payloads.
And this time the first set is actually the
first thing that we're changing which is the numbers,
it's not the alphabet.
So the first set we're gonna select numbers
And we're gonna say we want to start at zero and we want to end at 20
And we wanna step one at a time
and then the second set,
this is the one that we're actually manipulating the letters in here.
So this is the one that we've already done before in the previous attack.
So this is the one that we're gonna say route force
and we're going to try one character at a time
and that's pretty much it. So now we are ready to attack.
And as you can see in here the request count is going to be 756 requests that will need
to be made for you to figure out this
20 character length password but it is not unfeasible.
It's actually very very possible and it wouldn't take
too long even with the community version of Burpee.
Even if you don't have the professional version as you can see
it will not take more than an hour.
But obviously if you have the professional version it will be much much faster.
So you can simply just go ahead, have a coffee,
wait for this to figure out the whole password for you and then you'll
be able to construct it in a text file and log in as administrator.
So I'm gonna pause this
and I'll resume the video once we have all of the characters figured out.
Okay so the intruder has finished working
and you can see that here we have the requests ordered in order of the request.
And if you look at the length you'll see most of the requests have the same length.
But if you scroll down you'll see some of
them have a different length like this one right here
so that should be an indication that the response was a little bit different.
And if we look at the response in here and look for the welcome back,
you'll notice that we have it in here.
So that's our cue to know that the result was true meaning that
whatever character that we were trying to guess in this request is valid.
Now if we look at the character the character is B.
And that is at the 10th position of the password.
So now we know the 10th character in the password is the letter B.
Now instead of having to look through all of
the requests as you know we have over 700 requests
in here and looking for the ones with the
highest length we can just sort them by length.
So we just need to click in here twice.
And now we have all of the ones that have
the length of the response that contains the welcome back.
So now we know that all of these requests all the way
down to here are valid requests that actually guessed a correct character.
And we have the positions in here.
So all we have to do is simply open up a
text file and we're gonna just put them in here 1x1.
So let's go ahead and see what's the first character.
So this the first payload is the one that is guessing the character location.
So looking in here we can see that the first character is the letter N.
So we're gonna put an end in here enter to put the next one.
And let's look at the second character. Second character is number nine.
Next 3rd character is the letter D.
Next 4th character is # seven.
5th character is P.
6th character is v. 7th is f.
Eight S. P.
9th is the letter W. 10th is the letter B.
11. G.
12 8
13 is age
14 is six,
15 is D.
16017 is K.
18. T.
19 is X.
And 20 is the letter n.
So right now we have the password right here
and all we have to do is simply just remove the new line
character after each of these letters so we just have to contaminate them together
And there we go. Now we have the 20 character password.
So as you know it's a very strong password made of letters and numbers
20 characters very long but we managed to actually brute force it so we didn't
really we were guessing it at every character but the chances of us getting
the whole password was 100% due to the attack that we ran in here.
So I'm sorry if this was a bit boring
at the end to adding up the characters together but
I just wanted to make sure that you actually
understand how we construct the password from each character.
So the first payload was the one that is guessing the location of the character.
And the second payload is the one that is guessing the actual character.
We sort them out by length because our queue for
a true guess is the welcome back message.
So all of the ones that have this length in this
example are the ones that have the welcome back message and
that's what that's how we were able to construct a really
long and strong password and guess it using a blind SQL injection