Credential Attacks with Burp Suite Intruder

Hello! In our last lesson, we focused on how to discover valid usernames by analyzing an application's error messages and response timings. This is a critical first step, as knowing who the users are makes the next phase of an attack much more effective.

Today, we'll build directly on that knowledge. This lesson addresses the learning outcome: Execute credential-based attacks (brute-force, password spraying, credential stuffing) using Burp Suite Intruder. Armed with a list of potential or confirmed usernames, we will now learn how to systematically guess their passwords to gain unauthorized access. We will use Burp Suite's powerful Intruder tool to automate these attacks, turning a manual and tedious process into an efficient, targeted assault.

You will learn to differentiate between three key attack strategies and how to implement each one using the appropriate configuration in Burp Intruder.

1. The Credential Attack Playbook

Before we open our tools, it's essential to understand the strategic differences between the primary types of credential-based attacks. The one you choose depends on the information you have and the target's defenses (like account lockout policies).

Brute-Force: This is the classic approach: one username, many passwords. You take a single known user account (e.g., admin or a username you enumerated) and try thousands of passwords against it from a wordlist. This is fast but noisy, and it will likely trigger account lockout mechanisms if they exist.
Password Spraying: This attack flips the brute-force concept on its head: many usernames, one (or a few) common passwords. You take a large list of usernames and try a single, very common password (like Password123 or Summer2024) against all of them. This "low-and-slow" method is much stealthier and often bypasses account lockout policies that trigger after multiple failed attempts on a single account.

How Password Spraying Works — This diagram illustrates a password spraying attack. The attacker uses a single password (`Password123`) against multiple accounts, hoping to find one that uses the weak password, thereby avoiding account lockouts on any single account.

Credential Stuffing: This is an attack of opportunity, leveraging the common user habit of password reuse. Here, you use lists of known username/password pairs that have been leaked from data breaches on other websites. You are not guessing; you are testing credentials that were once valid elsewhere, hoping the user reused them on your target site.

2. Mastering Your Weapon: Burp Suite Intruder

Burp Suite Intruder is the tool of choice for automating these attacks. It works by taking a base HTTP request, marking one or more payload positions, and then systematically inserting data (payloads) into those positions from lists you provide.

The most critical part of configuring Intruder is choosing the correct Attack Type. There are four main types, and understanding them is key to launching the right attack.

To get a clear, practical overview of these attack types, watch the following video.

How to use Burp Suite's Intruder

The video 'How to use Burp Suite's Intruder' by Hacksplained provides an excellent and concise demonstration of the four main attack types: Sniper, Battering Ram, Pitchfork, and Cluster Bomb. This will build your foundational understanding of how Intruder works.

Watch the first 7 minutes and 27 seconds of the video. Focus on how each of the four attack types uses the provided payload lists differently. The visual demonstration of how payloads are inserted for each type is particularly helpful.

To summarize what you saw in the video:

Sniper: Uses a single payload set. It iterates through the payload list, placing each payload into one position at a time. If you have multiple positions, it attacks the first position completely, then the second, and so on. Ideal for brute-forcing a single parameter, like a password field for one user.
Battering Ram: Uses a single payload set. It places the same payload in all defined positions simultaneously. For example, if the payload is "test", it would send a request with username=test&password=test.
Pitchfork: Uses multiple payload sets (one for each position). It takes the first payload from list 1 and the first payload from list 2 and uses them together. Then it uses the second from each list, and so on. This is perfect for credential stuffing, where you have corresponding username/password pairs. It's also great for password spraying.
Cluster Bomb: Uses multiple payload sets and tests every possible combination. If you have 10 usernames and 10 passwords, it will make 100 requests. This is the most comprehensive but also the noisiest and most resource-intensive attack.

3. Executing Credential Attacks with Intruder

Now let's apply this knowledge to practical scenarios. We will walk through how to configure Intruder for brute-force attacks and credential stuffing.

Scenario 1: Brute-Forcing a Username and Password

In the last lesson, you learned to identify a valid username. The logical next step is to brute-force that user's password. This process involves two Sniper attacks: one to find the user (if you don't already know one), and a second to find their password.

The following video provides a complete end-to-end demonstration.

Master Burp Suite Intruder: Automate Fuzzing & Brute-Force Attacks

The video 'Master Burp Suite Intruder' by SoBatistaCyber demonstrates a full workflow. You'll see how to capture a login request, use a Sniper attack to enumerate a valid username, and then use a second Sniper attack to brute-force the password for that user.

Watch the video from 00:24 to 02:04 to see the request being sent to Intruder. Then skip to 09:04 and watch through to the end (15:09). Pay close attention to: Attack Setup: How the Sniper attack is used first on the username parameter, then on the password parameter. Payload Configuration: How simple wordlists are loaded into the payload options. Results Analysis: How deviations in response length and HTTP status codes (like 302 Found) are used to identify the valid username and then the correct password.

This video perfectly illustrates the core loop of this type of attack: launch an attack, analyze the results for anomalies, and use that information to refine your next attack.

Scenario 2: Credential Stuffing

For credential stuffing, we have a list of usernames and a corresponding list of passwords. Our goal is to try each pair (user1/pass1, user2/pass2, etc.). As we discussed, the Pitchfork attack type is designed for exactly this scenario.

For a clear, text-based guide, we'll turn to PortSwigger's documentation.

Credential stuffing with Burp Suite

This guide from PortSwigger, 'Credential stuffing with Burp Suite', provides a concise definition and a step-by-step tutorial on how to perform this attack using the Pitchfork method.

Read the entire article. It's short and to the point. Focus on the 'Steps' section, which shows how to mark both the username and password fields as payload positions and configure the two separate payload lists for a Pitchfork attack.

The key configuration for a Pitchfork attack for credential stuffing is shown here:

Burp Suite Intruder: Pitchfork Attack Configuration for Credential Stuffing — This screenshot shows Burp Intruder configured for a Pitchfork attack. Both the `username` and `password` parameters are marked as payload positions. This setup allows Intruder to use two synchronized lists of payloads, testing `user1` with `pass1`, `user2` with `pass2`, and so on, which is the core of a credential stuffing attack.

How to Adapt for Password Spraying

You can easily adapt the Pitchfork attack for password spraying. The setup is the same, but your payload lists will be different:

Payload Set 1 (Usernames): A long list of potential users.
Payload Set 2 (Passwords): A very short list, maybe even just one or two of the most common passwords.

Intruder will stop when the shortest list runs out, so it will try your one password against every user in your list, which is exactly what a password spray is.

Test your understanding!

You are faced with a login page for example.com.

You have discovered a single, valid administrator username: superadmin. You have a list of 10,000 common passwords. Your goal is to find the password for superadmin. Which Intruder attack type is most appropriate?
You have a list of 500 employee email addresses (which are used as usernames) for example.com. You want to test if any of them are using the password Company2024!. Which attack type would you use and how would you configure the payloads?
You have acquired a data dump from a breach at another-site.com, which contains 5,000 username/password pairs. You suspect users may have reused these credentials on example.com. Which attack type is designed for this exact scenario?

Show answer

Sniper. You have a single parameter to attack (the password field) for a single user. You would set the payload position on the password parameter and load your 10,000-password list into the single payload set.
Pitchfork. You would mark both the username and password fields as payload positions. For Payload Set 1, you would load your list of 500 employee emails. For Payload Set 2, you would add a single entry: Company2024!. Intruder will iterate through the lists, trying that one password for every single user.
Pitchfork. This is the classic use case for credential stuffing. You would set two payload positions (username and password). In Payload Set 1, you would paste the 5,000 usernames. In Payload Set 2, you would paste the 5,000 corresponding passwords. Pitchfork ensures that the first username is tested with the first password, the second with the second, and so on.

Conclusion

You have now moved from identifying users to compromising their accounts. By mastering Burp Suite Intruder, you can automate the otherwise impossible task of testing thousands of credential combinations.

Key Takeaways:

Three Core Strategies: You can choose between brute-force (one user, many passwords), password spraying (many users, one password), and credential stuffing (known user/pass pairs) depending on the situation.
Intruder Attack Types are Key: Your choice of attack strategy dictates your tool configuration. Sniper is for single-parameter brute-force, while Pitchfork is perfect for password spraying and credential stuffing. Cluster Bomb tests all combinations but is often too noisy.
Analysis is Everything: A successful attack isn't just about launching requests; it's about carefully analyzing the responses. Look for changes in status codes, response lengths, and page content to spot a successful login.

Next Lesson Preview:
Gaining access to an account is a major victory, but it's not the end of the story. Once logged in, the application uses a session token to manage your authenticated state. What if that token is weak or predictable? In our next lesson, we will analyze session token generation to identify weak or predictable identifiers, opening the door to hijacking the sessions of other users without even needing their passwords.