[] DVWA- security penetration testing -web brute force

Disclaimer: This article is a blogger original article, follow the CC 4.0 BY-SA copyright agreement, reproduced, please attach the original source link and this statement.

This link: https://blog.csdn.net/harry_c/article/details/102744978

The basic idea

Brute force should first do is to:
build weak passwords
to build common user name
to build a specific user name and password combination in accordance with the corresponding crack scene

Configuration practical operation

log in system

Setting the security level

Low security settings brute force attempt at
building a common user name and password combination
common user name common passwords

Common User Name	Common password
admin	password
root	root
test	test
administrator	administrator
manage	abc123
system	123456
test123	qwerty

We know based on the list can be composed of a combination of a total of permutations possibility of 7 * 7 = 49

burpsuite brute force

Ethereal

Setting the breaking content

Note: Here's Attack type should be set to Cluster bomb format

Import Dictionary

Storm began to break

According to user name and password data corresponding to the length we can determine the right:

as shown we can know the corresponding user name: admin password: password crack different levels of difficulty certainly a huge difference in the process so daily break time may be long time.

But also may encounter a lot of anti-violence break, such as setting IP blacklist, set the wrong logins, set a time delay of 1 minute Error Log to log in again, set the authentication code, etc.