lab writeup

In the Payload Options we give it a list of passwords to try. I will try
John’s password list found in /usr/share/john/password.lst in Kali.
The attack is going on, and you can see that each of the responses contains
the “Wrong password or email” error. Let’s create a filter so that
Burp Suite shows the correct password:
Go grab yourself a coffee while it works on the password, and let’s see
what happens in a few minutes…
The password is identified! Let’s try to log on with the credentials:
We can see Ralph’s account history. Let’s explore the inner area of the
cabinet. Like I said, I normally look at input fields for various injections,
usernames in HTML page source, hidden directories and file upload to
begin with. Here, the cabinet allows Ralph to upload a profile picture:
Page
17 of 22