Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

How to use intruder to make a dictionary attack against a login that uses websockets?

Abe | Last updated: Jan 27, 2016 09:47PM UTC

Typically if I wanted to use intruder to try and use common passwords to log in to an account I would take the following steps: 1) With site running through Burp Proxy I would make a login attempt 2) I would then find that request and send it to intruder 3) I would supply a list of common passwords to replace the password in the request and look for success indicator in the response. I am currently testing a Meteor.js application that uses sockets and I've noticed that when I make a login request (or any http request) it always responds with: "204 No Content". I am assuming that the response occurs through the web socket layer and not the HTTP layer, but i am at a loss as to how I would use intruder to check for success after making the request since the HTTP response is always the same. Can this be done? If so - can you give me any pointers on how to accomplish it?

PortSwigger Agent | Last updated: Jan 28, 2016 09:20AM UTC