Using Burp Suite's Intruder to find files and folders

Burp Intruder is a tool that allows us to replay a request automatically, altering parts of such request accordingly to lists of inputs that we can set or generate according to configurable rules.

Although it's not its main purpose, we can use Intruder to find existing yet nonreferenced files and folders as we can do with previously seen tools such as DirBuster and ZAP's Forced Browse.

In this recipe, we will undertake our first exercise with Burp Suite's Intruder and will use it to browse directories in our vulnerable virtual machine forcefully by using a name list included in Kali Linux.

How to do it...

Let's assume we have already set Burp Suite as a proxy for our browser and have visited WackoPicko (http://192.168.56.11/WackoPicko). Refer to the following steps:

1. In the Target or Proxy tabs, find a request to the WackoPicko's root URL, right-click on it, and select Send to Intruder:

2. Then change to the Intruder tab and then to the Positions...