Brute-forcing passwords with Burp Suite - Port Swigger
Summary: PortSwigger's guide describes using Burp Suite to brute-force a user's password, either with a wordlist of passwords collated from previous data breaches or by testing every permutation of a character set. It notes that an alphabetical password of five characters has over 11 million possible combinations, and that running these attacks on real sites usually requires bypassing defenses such as rate limiting.
Key Takeaway: The wordlist approach depends on the user's password already appearing in a breach corpus, and the exhaustive approach needs over 11 million requests for a five-character alphabetical password - so rate limiting is often the only thing standing between an attacker and a valid account.
Read the original at PortSwigger Research ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026