the-web-application-hackers-handbook

592 Chapter 14 n Automating Customized Attacks
Figure 14-1: Positioning payloads
When a payload is inserted at a particular position, any text between the
markers is overwritten with the payload. When a payload is not being inserted,
the text between the markers is submitted instead. This is necessary in order to
test one parameter at a time, leaving others unmodified, as when performing
application fuzzing. Clicking the Auto button makes Intruder set payload positions
at the values of all URL, cookie, and body parameters, thereby automating
a tedious task that was done manually in JAttack.
The sniper attack type is the one you will need most frequently. It functions
in the same way as JAttack’s request engine, targeting one payload position at
a time, submitting all payloads at that position, and then moving to the next
position. Other attack types enable you to target multiple positions simultaneously
in different ways, using multiple payload sets.
Choosing Payloads
The next step in preparing an attack is to choose the set of payloads to be
inserted at the defined positions. Intruder contains numerous built-in functions
for generating attack payloads, including the following: