Burp suite (from the scratch) Video 10 Video Lecture | Learn all about Burp Suite (English) - IT & Software

REI says now that we know the basics of
how to use intruder and what is what I
want to do now is go back and cover all
of the settings that I quickly glanced
over in that quick little demo because
we want to learn how to tune this tool
for the best performance and behavior
gotta get the most power out of it
so hop over to your positions tab again
the target tab there isn't much in here
it's all self-explanatory
now in the position section the first
thing that you may be wondering is all
right it's asking me for an attack type
what the heck is different between
sniper battering-ram pitchfork and
cluster bomb now in the example I showed
you in the last video I use sniper and
that's the easiest one to understand
basically as you saw you have a list
let's just say a list of passwords and
you have one injection point so it's
going to go through that list and plug
in each item one by one and see what
breaks so each payload item is placed in
a position one time
now what battering ram let me say that
we wanted to attack the login and also
the password so we wanted to attack this
field and the password field not just
one so what we could do is we could have
to be selected and also select battering
ram now what this would do is it would
go through your list and let me say let
me change this to something that's
easier to explain so say that we want to
throw in a list of all the letters
lowercase letters ABC indeed so what
it's going to do is each time it sends a
request to the user it's gonna use a new
item from that list in other words it's
gonna pay send BB send in other words it
goes through a single list then places
each payload into all of the injection
points each time now that's different
than pitchfork because pitchfork what
this does is it uses a different list
for each injection point so for example
for the login data it's a separate list
than passwords so you can actually have
I don't know your login for
say this so for the login you might want
to use these usernames and for the
passwords you might want to use
passwords so use two separate lists and
iterates through them and for each
request that makes to the server is
going to pull in usernames item one
password item one use your name item two
password item two so that's the
difference again better Graham one less
pitchfork uses two lists now cluster
bomb this is pretty much all
combinations from several lists it's
pretty much a granddaddy of them all and
as you can expect this one takes the
longest time and I really actually don't
like to use it that much if you find
yourself using this a lot then you're
probably not performing the right kind
of attacks because this is pretty much
just throwing everything everywhere and
that's that isn't really the best kind
of way to do it it's not the most
effective