How to do simple brute force attack with burp suite

What is brute force attack?

brute force is a kind of password based attack. normally attacker checks each and every possible combination until reaching the expected output. so an attacker should check the huge amount of data but the normal human cannot do this kind of things. that's why we must move on some predefine tools to do this kind of attacks.

work through
this is the sample login page. we are going to attack this page and get the login credentials.(note: this is a basic login form it does not have any prevention mechanism for brute force attack.)

let's try any value on this form and capture the data packet for analyzing.

after analyzed we can say these data packets have username and password, which we entered previously. so we have to forward this data packet to intruder tab (right click and select intruder option). now go to the intruder and mark the target variables which are carrying username and password. The below figure shows that.

Note: if you want to attack 2 variable at the same time you have to select cluster bomb attack in the attack type field.

Then go to payload option and insert your payload. Below image shows the way for adding payload.

Note: we have to add payloads for 2 variable but it shows only once. So likewise you can add payload by changing payload set.

now time to click start attack button. After clicking attack button you will get brute force window, that window will check each and every possible combination of given payload.

While checking the output we can identify all were giving same output but the 15th combination has a different value in length. So that combination may be the actual credential. Let's check 15th one. Below image shows 15th combination response.

We can assume username as admin and password as password from this response. Now let's check these credentialon the original login form.

WOW ITS WORKING!!!

NOTE: burp sutie configuration click_here