Brute-forcing logins with Burp Suite - Port Swigger
Summary: PortSwigger's guide shows how Burp Intruder can brute-force usernames and passwords in a single attack when enumerating a valid username first isn't possible, marking both values as payload positions and pasting in wordlists. It notes that running this against real websites usually requires bypassing defenses such as rate limiting, and that results are read by looking for anomalous error messages, response times, or status codes, such as a single 302 among the responses.
Bottom line: The technique's tell is a single outlier response - one 302 or one different error message among thousands - which means a successful guess can look like noise unless someone is watching response patterns, not just failure counts.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026