Dictionary attack on login pages with Burp Suite

Once we have a list of valid usernames for our target application, we can try a brute force attack, which tries all possible character combinations until a valid password is found. Brute force attacks are not feasible in web applications due to the enormous number of combinations and the response times between client and server.

A more realistic solution is a dictionary attack, which takes a reduced list of highly probable passwords and tries them with a valid username.

In this recipe, we will use Burp Suite Intruder to attempt a dictionary attack over a login page.

How to do it...

We'll use the WackoPicko admin section login to test this attack:

1. First, we set up Burp Suite as a proxy to our browser.
2. Browse to http://192.168.56.102/WackoPicko/admin/index.php?page=login.
3. We will see a login form. Let's try test for both username and password.
4. Now, go to Proxy's history and look for the POST request we just made with the login attempt and send it to...