We will be using the free version of Burp Suite that is built into Kali. Of course, we will look at other forms of breaking authentication in subsequent tutorials. With that caveat having been said, brute-forcing web forms is a good place to start in hacking web authentication. Also, this attack is dependent upon having a good password list as the application goes through every possible password looking for a match. Often, the web application will lock you out after a number of failed attempts. Please note that brute force attacks will not work against all web forms. In previous tutorials, we have used the Burp Suite proxy, but this time we will using the proxy in conjunction with the Burp Intruder capabilities in this Burp Suite of web hacking tools. One of the best tools to crack web authentication is Burp Suite.

Once again, we will be using the Damn Vulnerable Web Application (DVWA) on our Metasploitable OS with the security setting on high. Here we will examine at least one way to break web app authentication. Now, with that background, let's begin to examine ways that the web app authentication can be broken. In the my last installment in this series, we examined the ways that web apps authenticate users. Each of these applications is vulnerable to attack, but not all in the same way.

As you know, web applications are those apps that run the websites of everything from your next door neighbor, to the all-powerful financial institutions that run the world. In this series, we are exploring the myriad of ways to hack web applications.

Burp suite crack