Web App Penetration Testing - #3 - Brute Force With Burp Suite

Web App Penetration Testing - #3 - Brute Force With Burp Suite

by HackerSploit · View the channel on PSI

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 HackerSploit 👥 1.0M 📅 March 19, 2018 ⏱ 15 min 👁 161K 📄 tutorial 🧭 2026-10-10
Available in: English (current) Français

Keywords

Burp Suitebrute forceDVWAMetasploitableintruder

Summary

This tutorial focuses on performing a brute force attack against a login form using Burp Suite within the Damn Vulnerable Web Application (DVWA) hosted on Metasploitable 2. The presenter, HackerSploit, walks through the setup: configuring the browser to route traffic through Burp’s proxy, intercepting a login request, and then sending it to the Intruder tool. He explains the cluster bomb attack type, which combines multiple payload sets (usernames and passwords). The video demonstrates how to select the username and password fields as attack positions, clear unnecessary positions, and load custom payload lists or use Kali’s wordlists. After starting the attack, he analyzes HTTP status codes and response lengths to identify a successful login. The correct credentials are found: admin:password. The presenter emphasizes that this technique is effective on older or poorly secured websites and recommends proper authorization before testing. The video concludes with a successful login confirmation and an outlook for more advanced topics in the series.

157 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video provides valuable practical instruction for beginners in web application security. The argumentation is solid: the presenter clearly explains why cluster bomb is chosen (two parameters) and how to interpret responses to spot successful authentication. The demonstration is reproducible, with clear actions in Burp Suite. However, it lacks theoretical depth on bypassing protections or real-world attack scenarios, but given its beginner focus, it effectively meets its goal.

Scientific Rigor, Source Quality, Title Accuracy

The rigor is adequate for a tutorial: the methodology is logically sequenced, and the presenter shows the exact steps. Sources are limited to the description links (HackerSploit website and Android app) and the inherently used tools (DVWA, Metasploitable, Burp Suite) which are not cited with URLs. The title perfectly matches the content. There is a short sponsorship mention (PureVPN affiliate) but does not affect the technical accuracy.

150 words

Title / Content Match

Title accurately reflects the video's content; it is a focused tutorial on brute force attacks using Burp Suite within a web application penetration testing series.

Quality & Reliability

8/10

Clear, step-by-step tutorial demonstrating a brute force attack on DVWA using Burp Suite Intruder. Instructions are accurate and reproducible, with explanations of key concepts. Slight lack of depth in security theory but excellent for beginners.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • HackerSploit Website — Mentioned in the video description as the creator's website for additional resources and contact.
  • HackerSploit Android App — Mentioned in the video description as a companion app for content.

External References

Contribution & Novelties

The video serves as a straightforward tutorial for beginners, demonstrating a classic brute force attack with Burp Suite Intruder. It adds value by breaking down the process into clear steps, especially explaining the cluster bomb attack type and how to interpret response lengths. While not novel for advanced practitioners, it effectively teaches foundational skills.

Pour aller plus loin :

101 words

Radar Profile

The radar profile shows strong scores in information quality and reliability, with slightly lower quantity and technical depth. This indicates a focused, well-executed tutorial with limited breadth but accurate and useful content.

Reliability 8/10

💬 Sur les 30 commentaires analysés, la tendance est très positive : la majorité remercient le présentateur pour la clarté et la qualité pédagogique, quelques-uns ajoutent des conseils pratiques sur les listes de mots ou la configuration du proxy.