Scribd
Upload
8 views5 pages

Module 2 Experiment 5

The document outlines an experiment demonstrating the vulnerability of weak passwords through brute-force and dictionary attacks using DVWA and Burp Suite. It provides a step-by-step procedure for setting up DVWA, conducting attacks, and emphasizes the importance of strong password policies. The document also includes links for downloading necessary software and screenshots for reference.

Uploaded by

Movies 4 U khan
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
8 views5 pages

Module 2 Experiment 5

The document outlines an experiment demonstrating the vulnerability of weak passwords through brute-force and dictionary attacks using DVWA and Burp Suite. It provides a step-by-step procedure for setting up DVWA, conducting attacks, and emphasizes the importance of strong password policies. The document also includes links for downloading necessary software and screenshots for reference.

Uploaded by

Movies 4 U khan
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

EXPERIMENT:- 5

BRUTE-FORCE AND DICTIONARY ATTACKS

AIM

To demonstrate the vulnerability of weak passwords on login pages using DVWA and
emphasize the importance of implementing strong password policies.

MATERIALS:

1. Computer with internet access


2. Browser (Chrome, Firefox, etc.)
3. DVWA (Damn Vulnerable Web Application)
4. Burp Suite

PROCEDURE:

1. Set up DVWA:

Download and install DVWA on your local machine or server. You can find the installation
instructions on the DVWA GitHub repository.

Configure DVWA according to your environment (e.g., database settings).

2. Access DVWA:

Open your web browser and navigate to the URL where DVWA is installed (e.g.,
[Link]

3. Login to DVWA:

Enter the default username and password (admin/password), unless you've changed them
during installation.

4. Set Security Level:


a. In DVWA, navigate to the "DVWA Security" page.
b. Set the security level to low or medium to make the application vulnerable to
attacks.
5. Navigate to the "Brute Force" and "Dictionary Attack" pages:
In DVWA, go to the "Brute Force" and "Dictionary Attack" tabs under the "DVWA Security"
menu.

6. Configure Burp Suite:


a. Launch Burp Suite and configure your browser to use it as a proxy.
b. Navigate to the DVWA login page through the proxy to intercept the requests.
7. Brute-Force Attack:
a. On the Brute Force page in DVWA, enter the target username (e.g., admin) and
initiate a brute-force attack.
b. Use Burp Suite's Intruder tool to automate the attack:
i. Capture the login request in Burp Suite and send it to the Intruder.
ii. Configure the Intruder to use a list of passwords as payloads and set the
target position where the password parameter is located.
iii. Start the attack and observe how Burp Suite iterates through the password
list, trying different combinations until it finds the correct one.
8. Dictionary Attack:
a. On the Dictionary Attack page in DVWA, enter the target username (e.g., admin)
and specify a dictionary file containing common passwords.
b. Use Burp Suite's Intruder to automate the attack:
i. Capture the login request in Burp Suite and send it to the Intruder.
ii. Configure the Intruder to use the specified dictionary file as payloads and
set the target position where the password parameter is located.
iii. Start the attack and observe how Burp Suite tries passwords from the
dictionary until it finds the correct one.

LINKS FOR SOFTWARE’S

1. [Link] (Burp Suite)


2. [Link] (XAMPP Server)
3. [Link] (DVWA setup)
SOME SCREENSHOTS

1. XAMPP 1

3
1. DVWA

Fill Username and Password

Perform Brute Force Attack in these


sections
3. BURP SUITE

You might also like