Brute Force Attack

 Brute Force Attack is a popular cracking method with tapping Users & Password one by one in a short time using Machine or Tool, for now I going to show you how to hack website using Brute Force to Knowing What Users and Password which is suitable in Database that webapp using Machine or Tool BurpSuite

Step 1. Access website Bwapp which has been installed in your Lab, and now we try to input wrong user and password, to know what response provided by web, and now we already know the keyword response is Invalid 

Step 2. Now input again user and password with intercept is on in burpsuite, after the traffic already intercept right click and select Send to Intruder 

Step 3. The default will showing like this

Step 4. Now we change like the picture below
Attack Type    : Cluster Bomb
Login              : $admin$
Password        : $admin$

Step 5. Click tab payloads this is for users
Payload set        : 1 
Payload type      : Simple List 
Payload Options: (add all user or if you have wordlist upload to burpsuite) 

Step 6. Keep in the tab payload but this is for passwords

Payload set     : 2 

Payload Type     : Simple List 

Payload Options : (add all password or if you have wordlist upload to burpsuite) 

Step 8. Click tab Options, and look at Grep Match, add the response of the webapp, and then click Start Attack Example : Invalid

Step 9. The burpsuite will check one by one users and passwords, if ther is user and password match look at Invalid will showing uncheck, the webapp no response keyword invalid 

Step 10. Now we try to login to the webapp, and the result we can login using user : bee and password : bug

If you have Website and you want prevent from this attack you can using WAF or you can using Captcha, so if there are Traffic attack to your website using Brute Force, WAF or Captcha can identify that traffic is BruteForce in a way if there are User try to login 5 wrong times in a row within 1 minutes WAF and Captcha can identify and will block or appears the Captcha Authentication 

Thank You