Burp Suite Intruder for Authorised Login Testing: Lab Guide and Defences

Key takeaways

• Intruder automates repeated requests. Used on a login, it tests whether the application resists password guessing, which is a legitimate part of an authorised web test.
• Use it only on your own lab (DVWA, Juice Shop) or on systems with written permission. Brute forcing a real site is illegal under India's IT Act and can lock out real users.
• Burp Community Edition throttles Intruder. Professional removes that limit. Check PortSwigger's documentation for current editions.
• A good result for the defender is that guessing is blocked or slowed: rate limits, lockout, CAPTCHA and MFA.
• Report findings with evidence and fixes, and test lockout carefully so you do not lock accounts that matter.

What is Burp Suite Intruder?

Burp Suite is a web application testing proxy from PortSwigger. Its Intruder tool takes one HTTP request, lets you mark positions in it, and sends many copies with different payloads substituted in. Testers use it for parameter fuzzing, checking enumeration, and testing whether a login form limits guessing attempts. Official documentation is at PortSwigger's Burp documentation.

Is brute-force testing legal?

Only with permission. Guessing passwords against a system you do not own or have written authorisation to test is unauthorised access under India's IT Act. It can also lock out real users and trigger incident response. Practise on a lab such as DVWA or OWASP Juice Shop in your own virtual machines. On a client job, put login testing, its limits and lockout risks in the written scope.

Do you need Burp Suite Professional?

No for learning. The Community Edition includes Intruder, but it is deliberately slowed down. Professional removes the throttle and adds features. For a lab with a short payload list, Community is enough. Check the current edition comparison on PortSwigger's site.

How do you set up a safe lab?

1. Run DVWA in a VM on a host-only network. Set the DVWA security level to low for practice.
2. Open Burp Suite and check that the Proxy listener is on 127.0.0.1:8080.
3. Configure the browser (or use Burp's built-in browser) to use that proxy.
4. Visit the DVWA login or its brute force page and confirm requests appear in Proxy, HTTP history.

How does an Intruder test of a login work?

1. Capture one login attempt with a wrong password for a lab account. Find it in HTTP history.
2. Send it to Intruder. Right-click and choose Send to Intruder.
3. Set positions. Clear the default markers, then mark only the password value. Use the Sniper attack type for one position.
4. Choose payloads. Use a short list you create for the lab, for example ten test passwords including the correct one.
5. Start the attack and sort the results by status code and response length. A successful login usually differs in length, a redirect or a message.
6. Record what happened. Did the application slow down, block you, show a CAPTCHA or lock the account after a number of attempts? That is the real finding.

The aim for a professional tester is not to "break in". It is to answer: does this login resist guessing, and how do we know?

What attack types does Intruder offer?

How do you read the results?

Compare status codes, response length and time. Add a grep-match rule for a message such as "Welcome" or "incorrect". A sudden change after N attempts (a 429 status, a lockout message or an added delay) shows a control working. If every attempt gets the same fast reply with no limit, report missing rate limiting.

How do you prevent brute-force attacks?

1. Multi-factor authentication. Even a guessed password is not enough.
2. Rate limiting per account and per source address, with increasing delays.
3. Account lockout or step-up checks after repeated failures, designed so attackers cannot easily lock out real users.
4. Strong password policy and checking against lists of breached passwords. See NIST Special Publications on password policy (SP 800-63B).
5. CAPTCHA or proof-of-work after suspicious behaviour.
6. Uniform responses that do not reveal whether a username exists.
7. Monitoring and alerts on many failed logins and on logins from new locations.
8. Web application firewall rules as an extra layer.

The OWASP Cheat Sheet Series includes authentication guidance. Broken authentication appears in the OWASP Top 10 family of risks.

How should you report a finding?

State the endpoint, what you tested, how many attempts were allowed before any control, the evidence (requests and responses), the risk and the fix. Include the test window and the accounts used. Mention what you did not test.

Next steps

To practise this safely with a trainer, see WebAsha's web application hacking and security course. Also read what Burp Suite is and how it is used.

Related reading

• How to Hack Linux, Windows System/Server (Brute Force ssh) with Metasploit?
• Step-by-Step Guide to OWASP ZAP for Vulnerability Testing
• How to Hack and Penetration Test WordPress Sites | A Complete Ethical Hacking Guide with Real Commands, Tools, and Examples for Beginners and Experts